05 — Existing DOT Reuse / Rejection Matrix for C1

Macro: DOT_MANAGE_LEGO_TRANSITION_SURVEY_FOR_C1_DRYRUN · Date: 2026-06-22 · Read-only.

Answers macro §3.4 — reuse-first: every C1 need is mapped to existing DOT candidates (live dot_tools = 309) before any new DOT is proposed. Columns: need · existing candidate(s) · registry evidence · reuse? · reject reason · required LEGO adaptation · new DOT needed? · birth/governance path if new.

Registry evidence is from live read-only probes (2026-06-22). "Reuse pattern" = reuse the naming/contract pattern of an existing, governed DOT; the C1-specific instance still travels Path A (03) to be registered.

---

#	C1 need	Existing candidate(s)	Registry evidence	Reuse?	Reject reason (if any)	Required LEGO adaptation	New DOT?	Birth/gov path if new
1	schema ensure (ensure C1 table exists)	DOT_SCHEMA_ENSURE (generic); dot-schema-*-ensure family	75 schema/ensure rows, all active	PATTERN reuse	generic DOT_SCHEMA_ENSURE has no canonical_operation_vocab shape / no R_C1 / no manifest binding	author DOT_C1_SCHEMA_ENSURE following the family; PK (operation_code,protocol_version), write-once	YES	A1→A2→A4 (register via dot-dot-register)
2	Directus collection / field ensure	DOT-120 / DOT_COLLECTION_REGISTER; DOT-TAC-COLLECTION-REGISTER	active (domain=collection)	reuse as primitive	(no reject — this is the governed collection-create primitive)	invoke for governance_canonical_operation_vocab with C1 fields; NOT dot_iu_create_collection (IU staging, writes iu_piece_collection, no Directus DDL)	NO (instance call)	uses existing DOT via governed path
3	table_registry ensure (register the collection as governed)	DOT_SCHEMA_TABLE_REGISTRY_ENSURE	active	reuse (registration-step pattern)	n/a	ensure a table_registry row for C1 (currently 0 C1 rows of 21)	NO	existing DOT
4	DOT contract register (bind producer/verifier)	DOT-REGISTER (dot-dot-register) = lawful registrar; precedent contract pair DOT_KG_EXPLAIN/_VERIFY	dot_agent_api_contract = 2 rows (KG only); DOT-REGISTER present but creds-absent	reuse path + precedent	cannot run here (admin creds absent — operator Gate-B)	register DOT_C1_VOCAB_BUILD/_VERIFY (+ schema/preflight/harness/rollback contracts) following KG mode/no-mutation pattern	the contracts are new rows	A4 (operator)
5	dot_tools / CAT-006 catalog update	DOT-015 / dot-catalog-sync	CAT-006 active, on-deploy, record_count 309	reuse as-is	n/a	runs on-deploy after C1 DOTs registered; will also surface the 309↔163 drift	NO	existing DOT
6	manifest resolver (R_C1)	none (no resolver DOT in dot_tools)	0 matches for resolver/manifest	NO	no governed DOT computes a canonical manifest/hash	author resolver inside DOT_C1_VOCAB_BUILD over apr_action_types (own cols; join to process_axis_action_vocabulary DROPPED — 0 matches) + cser-v1 hash	YES (logic, in build DOT)	A1→A4
7	vocab build (producer)	precedent DOT_KG_EXPLAIN (producer pattern)	1 producer row	pattern reuse	KG is domain-specific (explain), not a vocab build	author DOT_C1_VOCAB_BUILD (DRY_RUN, no_mutation_assertion=true)	YES	A1→A2→A4
8	vocab verify (verifier)	precedent DOT_KG_EXPLAIN_VERIFY	1 verifier row	pattern reuse	KG verifier checks KG output, not C1 grant/manifest	author DOT_C1_VOCAB_VERIFY — ~11–13 reject codes; status='active' (NOT granted); single-use CAS consume; exact action-set (no loose superset); manifest/plan/carrier-bound	YES	A1→A2→A4
9	preflight	precedent view v_dotkg_realrun_preflight	view exists; verdict NO_GO	pattern reuse	KG preflight is KG-gated	author DOT_C1_PREFLIGHT (7 checks) + v_c1_*_preflight view	YES	A1→A4 + view
10	bad-input harness	none in dot_tools	0 matches	NO	no governed harness DOT	author DOT_C1_BAD_INPUT_HARNESS (19 cases, all fail-closed, 0 seal; real-run raises C1_PROD_REAL_RUN_BLOCKED) — proven as logic in sandbox	YES	A1→A4
11	evidence readback	none dedicated; generic query_pg read-only	0 matches	NO (governed); read-only probe suffices for survey	no governed readback DOT	author DOT_C1_EVIDENCE_READBACK (read-only)	YES	A1→A4
12	rollback / check	DOT-062 / dot-rollback; DOT_C1_ROLLBACK_CHECK (sandbox-only)	DOT-062 active (infrastructure.deploy, coverage=partial)	EXTEND, not clone	DOT-062 generic, not C1-carrier-scoped, no versioned-supersession oracle	extend DOT-062 for the C1 rollback step (dismantle→0 rows, audit retained, orphans 0)	NO (extend)	governed change to existing DOT
13	retire / supersede	DOT-112 dot-entity-retire; DOT-314 dot-matrix-retire; DOT_NRM_RETIRE; fn_retire_gate_check()	active/published; retire safety-check live	reuse pattern	status-transition fn + vocabulary absent (Path B8)	use existing retire DOTs for C1 versioned supersession when needed	NO	existing DOTs

---

Reuse-first summary

• Reuse as-is / instance call: DOT-120 DOT_COLLECTION_REGISTER, DOT_SCHEMA_TABLE_REGISTRY_ENSURE, DOT-015 dot-catalog-sync, retire DOTs (DOT-112/DOT-314/DOT_NRM_RETIRE). → 4 needs need no new DOT.
• Reuse PATTERN, new C1 instance must be registered: schema-ensure (#1), contract-register path + KG precedent (#4, #7, #8), preflight (#9).
• Extend existing: DOT-062 dot-rollback (#12).
• No existing DOT (author new): R_C1 resolver/manifest (#6, inside build), bad-input harness (#10), evidence readback (#11).
• Explicit rejections with reason: generic DOT_SCHEMA_ENSURE (no C1 shape); dot_iu_create_collection (IU staging, not Directus DDL — Codex-flagged); KG/GOV/TAC *_VERIFY (domain-specific, no C1 binding); cloning a net-new rollback instead of extending DOT-062.
• Sandbox DOT_C1_* (7 contracts) are emulator-only and deliberately NOT in governed dot_tools/CAT-006 — so …HOLD_DOT_REGISTRY_NOT_UPDATED correctly does not fire (no governed DOT was created by the sandbox).

Net: the C1 dry-run needs roughly 5–7 new governed DOTs/contracts (schema-ensure, vocab-build [incl. R_C1], vocab-verify, preflight, bad-input-harness, evidence-readback) + 1 extension (DOT-062) + reuse of 4 existing DOTs. All new ones travel the SAME governed birth/registration path (03 Path A) — no new path, no forbidden lane. No orphan: each new DOT gets an admission record (A2).