01 — Preflight Baseline (Hard Gate 0)

All preflight gates verified before BEGIN via the independent read-only channel (query_pg, READ ONLY role) and re-confirmed by the script's own PRE_CENSUS. Channel for the transaction: ssh contabo → docker exec -i postgres psql -U workflow_admin -d directus (PG 16.13), script on stdin, default terminal statement ROLLBACK, ON_ERROR_STOP on.

1.1 Gate results

Gate	Required	Observed	Verdict
Phase-1 substrate exists	views + tables present	v_object_effective_owner eo_cols=9; ownership/ruleset/scan_run/cand_state tables present	✅
Candidate/owner/ruleset rows at base	0 / 0 / 0 / 0	ownership=0, ruleset=0, scan_run=0, cand_state=0	✅
Governance event types active=false	active=0	event_type_registry gov=5, active=0	✅
Governance event_outbox emit	0	gov_emit=0	✅
system_issues count (baseline anchor)	stable	198,442	✅
Approval / e-sign counts	matches prior	approval_requests=211, apr_approvals=42, os_proposal_approvals=0	✅
dot_tools count	309	309	✅
apr_action_types	14 (post test-mode build)	14	✅
Responsibility scopes	6	6 = {approval,audit,execution,health,policy,render}	✅
governance_registry	9	9 (owners GOV-COUNCIL/GOV-DOT/GOV-SIV present)	✅
Idle transactions	0	idle_in_tx=0	✅
Scanner/worker/backfill active	none	gov etr active=0; no run rows; cand_state=0	✅
F-2 objects/seams back to base	inert WHERE false	inv_rows=0, cont_rows=0, eo_rows=0, gap_rows=0; pg_get_viewdef=WHERE false	✅
Rollback plan ready	default ROLLBACK	terminal statement is ROLLBACK; ON_ERROR_STOP=fail-safe	✅

1.2 PRE_CENSUS (entry anchor, verbatim)

 ownership | ruleset | scan_run | cand_state | relations | gov_emit | sys_issues | eo_cols | inv_rows | cont_rows | eo_rows | gap_rows
-----------+---------+----------+------------+-----------+----------+------------+---------+----------+-----------+---------+----------
         0 |       0 |        0 |          0 |         8 |        0 |     198442 |       9 |        0 |         0 |       0 |        0

relations=8 (governance_relations, agency→law owner edges — unrelated to collection containment, see doc 05 §5.6).

1.3 Trigger-safety preflight (new in F-3)

The five write/probe targets were checked for triggers that could fire side-effects under the transaction:

• governance_object_ownership, governance_ruleset, candidate_scan_run, governance_candidate_state — 0 triggers (confirmed via pg_trigger). Writes are pure inserts with no cascade.
• collection_registry has 11 active triggers (birth, auto_code, onboarding gate, desc guards, label assign, count/orphan refresh, dot-origin validate) — but F-3 only SELECTs from it (inventory + containment seams). No write to collection_registry ⇒ none of these fire. (Confirms F-83-1 birth-trap is not on the F-3 path.)

1.4 Real containment source preflight

collection_registry."group" is a live varchar column populated for all 35 governed BIRTH_REQUIRED collections (folder grouping): GRP-AI, GRP-BUSINESS, GRP-GOVERNANCE, GRP-REGISTRY, GRP-WORKFLOW. Confirmed the 5 group codes do not collide with any governed collection_name (groups are parent-only ⇒ structurally acyclic; verified count=0 for GRP-* as collection names). This is the genuine source used for Seam-B — not a fixture.

1.5 Preflight verdict

PASS. All gates green. Baseline identical to F-2 entry/exit (and to the operational-readiness recheck): the substrate is inert, fail-closed, and unmutated. Transaction authorized to begin.