04 — G3a: Contract-register path (DOT-100%, C1-scoped, minimal)

1. Gap confirmed live

• Live dot_agent_api_contract = 2 rows, both from migration DOT_AGENT_API_CONTRACT_DISPATCHER_2026_06_04; DOT_C1* = 0.
• Local grep -rl "dot_agent_api_contract" dot/bin = 0 → no existing DOT writes this table. Reuse is impossible; a minimal new DOT is required.

2. Contract table shape (live, read-only) — what the C1 rows must fill

Columns: id, dot_code, candidate_code, operation, role, paired_dot, mode, fixture_ref, output_namespace, no_mutation_assertion, endpoint_ref, expected_output_schema, verifier_schema, error_behavior, observation_write_policy, contract_status, source_macro, created_at, notes. Live precedent rows to mirror exactly:

DOT_KG_EXPLAIN        | producer | DRY_RUN     | endpoint_bound
DOT_KG_EXPLAIN_VERIFY | verifier | VERIFY_ONLY | contract_ready

3. Staged minimal DOT — dot-c1-contract-register

Artifact: staged-artifacts/scripts/dot-c1-contract-register. Scope: only the 2 C1 rows. Not a generic contract registry.

• Job: governed POST /items/dot_agent_api_contract for the 2 rows in payloads/dot_agent_api_contract_rows.json (DOT_C1_VOCAB_BUILD producer/endpoint_bound, DOT_C1_VOCAB_VERIFY verifier/contract_ready) — payloads mirror the KG pair field-for-field.
• Auth: dot-auth (DOT-internal), not ad-hoc.
• Idempotency: per-row pre-check filter[dot_code][_eq] → skip if exists (never duplicates).
• dry-run: --dry-run prints [NEW] DOT_C1_VOCAB_BUILD / [NEW] DOT_C1_VOCAB_VERIFY, writes nothing.

4. Birth / admission / governance for the new DOT (it must be DOT itself)

dot-c1-contract-register is a DOT and follows the full lifecycle BEFORE it may run:

1. Birth — dot-species-register maps dot-c1-contract-register; dot-birth-backfill records _dot_origin.
2. Admission — ledger row (report 07 / staged dot-manage) marking status.
3. Registration — registered as a dot_tools row by the patched registrar with --only-prefix dot-c1- (it is one of the 7 in report 02 Run C2: DOT_C1_CONTRACT_REGISTER), then dot-catalog-sync.
4. Pairing — Cấp B → paired DOT-HEALTH-DOT.
5. Rollback/retire — contract_status=retired on the 2 rows; dot-entity-retire on the DOT.

5. dry-run payload (per macro §3.3)

{"dot_code":"DOT_C1_VOCAB_BUILD","role":"producer","mode":"DRY_RUN",
 "endpoint_ref":"http://incomex-agent-api-executor:8090/dispatch",
 "fixture_ref":"FIXTURE:dot:c1:vocab:v1","output_namespace":"DRYRUN-NS:dot:c1:vocab",
 "no_mutation_assertion":true,"error_behavior":"fail_closed_no_mutation",
 "contract_status":"endpoint_bound","source_macro":"C1_LEGO_DRYRUN_PLAN_HARDENING_NO_PROD_WRITE"}

(+ verifier row, endpoint_ref:null, contract_status:contract_ready — full text in payloads/dot_agent_api_contract_rows.json.)

6. Readback & rollback (per macro §3.3)

• Readback: SELECT dot_code,role,mode,contract_status FROM dot_agent_api_contract WHERE dot_code LIKE 'DOT_C1_%' → expect 2; KG rows untouched (still 2) ⇒ total 4.
• Rollback/retire: PATCH contract_status=retired on the 2 C1 rows (retire-not-delete).

7. Verdict

G3a = path PROVEN (staged). A C1-scoped, minimal, idempotent, replaceable contract-register DOT closes the gap DOT-100%. No general contract registry created. 0 executed.