16 — Safety / No-Fake Audit (Phase 17)

All values verified unchanged after the additive DDL:

• Official AX-PROCESS RP: 0 (axis_assignment for AX-PROCESS = 0). No fake official.
• governance_object_ownership: 0. No fake owner.
• PROC-OWN: 5 requests, 0 votes (apr_approvals joined on PROC-OWN requests = 0). No fake vote.
• axis_registry: 2 (AX-PROCESS, AX-TOPIC candidate), 0 active. AX-TRIGGER still synthetic — no canon.
• axis_assignment: 25 (unchanged).
• REAL_RUN: process_dot_runtime.real_run_enabled false; also dry_run_only true, execute_enabled false, piece_event emit_enabled false, iu_core operator_runtime_enabled false. No REAL_RUN.
• event_type active: 30. No event activation.
• trigger_guard_alerts: 129 (unchanged).
• birth-free DDL: birth_registry 1,200,161 before == after the apply. DDL-attributable births 0. Later reads show 1,200,292 = background drift (entity_labels / system_issues / changelog), some plausibly generated by the four crash-recovery cycles; none attributable to the view/function DDL.
• v1 sentinel retained (RGT6); no source-IU edit; no UI push/deploy; no unsafe birth/canon.

Forbidden actions — none taken

No fake owner/vote/official RP, no unsafe birth/canon, no event activation, no REAL_RUN, no source-IU edit, no unsafe UI push/deploy, no replacing current with generated before parity proven, no hiding parity gaps (substrate_parity false surfaced openly), v1 sentinel not removed.

Note on the crash incident vs no-fake

The four OOM crashes were caused by querying a too-heavy guard view (planner OOM); they were not data mutations. Crash recovery preserved all governance/no-fake state exactly. The audit confirms zero drift in every no-fake metric.