Methods:
- immutable published R13A facts and VM101 Machine Git archive;
- source-controlled router-ops helper and guard;
- regression fixture reproducing the exact core.worktree/CWD failure;
- independent git archive count;
- active-code audit;
- optional router-ops Git commit/push when /opt/router-ops is a clean Git repository.

Limitations:
- no VM100, VM101 or VM121 live inspection;
- no machine code or runtime change;
- no refresh, rebalance, route, service or VPN action;
- historical R13A report remains immutable and is corrected by this later STEP.