06 — B2 · Bind authorize_build_step.handler_ref via DOT-approved path

Result: NOT EXECUTED. Gated by Phase A HOLD.

State (unchanged)

• authorize_build_step.handler_ref = unimplemented (before == after).

What would have happened (documented, NOT done)

• Bind handler_ref from unimplemented → dot-apr-execute:execute_authorize_build_step via an owner-approved DOT-governed migration runner (origin = MIGRATION authority-approved path), with readback + rollback.

Forbidden paths NOT taken

• No UPDATE apr_action_types SET handler_ref = … raw SQL. (query_pg is RO-only and AST-blocks writes regardless; no other SQL channel was used.)
• No manual Directus update of the action row.
• No manual registry bypass.

The reject code GOVERNED_C1_DRYRUN_REJECT_MANUAL_BINDING_SQL did not fire because no binding was attempted at all — neither governed nor manual.

B2: NOT EXECUTED (gated). before == after. No ad-hoc SQL, no manual write.