dot-iu-cutter v0.2 — P0-6 + P0-5 Remainder Risk Review Note

document_path: knowledge/dev/laws/dieu44-trien-khai/v0.2-ddl-authoring/dot-iu-cutter-v0.2-p0-6-p0-5-remainder-risk-review-note-2026-05-16.md
revision: r2
supersedes: r1 (2026-05-16)
date: 2026-05-16
author: Agent (Claude Code CLI, Opus 4.7 1M)
phase: v0.2 — P0-6 + P0-5-remainder DDL AUTHORING REVISION (risk review note r2)
status: risk_class STANDARD (carried from GPT design review; unchanged by the A-1 fix)
a1_status: RESOLVED (RS-2 retired — see §2)
dry_run_allowed: false (until GPT r2 review PASS)
production_migration_allowed: false

⛔ r2 update: the A-1 PK assumption is resolved by direct production read-only observation (decision_backlog_entry PK = entry_id uuid). The r2 DDL renames child columns to the entry_id family. Risk class is unchanged: STANDARD — a column-name correction is not a risk-class event. r1 of this note is superseded.

---

§1 — Risk Class (carried, not re-opened)

ratified_risk_class: STANDARD            # GPT design review 2026-05-16
r2_reconfirmation: STANDARD              # A-1 fix is a name correction only
escalation_to_HIGH_council: NO
basis: 4 NEW EMPTY tables in live cutter_governance; no LIVE-table ALTER;
  in-schema FK only; no cross-schema FK / PG enum / lookup table / Đ24 lookup
  FK / CHECK / trigger / DEFAULT / INSERT / seed / backfill; additive + empty
  + DROP-rollback pattern proven 3× (v0.1, Phase α, P0-2).
r2_delta: child column renames (decision_id→entry_id;
  from_decision_id→from_entry_id; to_decision_id→to_entry_id) + FK targets →
  decision_backlog_entry(entry_id). Pure shape correction; risk-neutral.

§2 — DDL-Authoring Risk Surfaces (r2)

#	Surface	Risk	Mitigation (r2)
RS-1	4 new tables in a live schema	additive structural	single BEGIN…COMMIT atomic; empty; DROP-table rollback
RS-2	A-1 assumption (PK guess)	wrong FK type/name	RETIRED — A-1 resolved by production read-only observation; r2 FKs target the confirmed decision_backlog_entry(entry_id). Residual = the pre-exec gate now confirms (entry_id,uuid) rather than guesses
RS-3	nullable composite FK (review→unit_block)	NULL semantics	MATCH SIMPLE documented; V-13 asserts
RS-4	review_decision self-FKs	self-ref at create	created within CREATE TABLE; NULLable; DROP removes them
RS-5	soft refs (escalation_ref, cut_change_set_ref)	dangling possible	intentional decoupling; app-layer/P1; verification asserts NO FK on them. Note: escalation_ref→decision_backlog_entry stays SOFT (uuid) — the A-1 name issue never touched it
RS-6	enum-class as text (BATCH-1)	no PG value enforcement	ratified; documented values + app-layer; V-18/19/20 assert no enum/lookup leak
RS-7	reviewer independence / cross-sign	silent override / criterion-28	field-level HIGH but app-layer/P1 (RD-6) — NOT create-time
RS-8	dependency-graph cycles	cyclic edges	app-layer v0.2 (DBD-1); no trigger/CHECK — NOT create-time
RS-9	history-preservation across rollback	losing trail	N/A at create (empty); P1/post-backfill concern; flagged for Đ32
RS-10	collateral mutation of LIVE objects	accidental ALTER / SSOT touch	zero ALTER; r2 adds NO column/constraint to decision_backlog_entry; V-23..29 assert byte-stable
RS-11	no-DEFAULT on NOT NULL	INSERT burden → P1 writer	intentional, consistent with P0-2; empty table → inert
RS-12 (r2)	residual decision_id-family name leak from r1	executing stale r1	r1 explicitly SUPERSEDED/ DO-NOT-EXECUTE; V-21a asserts no decision_id/*_decision_id column survives in r2

§3 — Special Đ32 Attention (deferred; not create-time)

Unchanged from r1: reviewer independence (RD-6, app-layer), cross_signed_by_dot_verifier (criterion 28, app-layer), reviewer_identity audience scope (G-5 internal-only), history/dependency backfill rollback semantics (P1; separate risk review).

§4 — Residual Risk Register (r2)

RR-1: app-layer enum drift (text vs documented values) — P1/app-layer; accepted (BATCH-1)
RR-2: app-layer cycle/independence/cross-sign enforcement — P1; accepted (RD-6/DBD-1)
RR-3: A-1 PK assumption — RETIRED (resolved by observation; r2 targets entry_id)
RR-4 (r2): r1 stale-execution risk — mitigated by explicit supersede + V-21a guard
status: all residuals app-layer / P1 / retired; none escalate STANDARD

§5 — Hard Boundaries

revision: r2
r1_superseded: TRUE
ddl_executed: FALSE
mutation_performed: FALSE
risk_class_re_ratified_here: FALSE (carried; unchanged by r2)
dry_run_allowed: FALSE (until GPT r2 review PASS)
production_migration_allowed: FALSE
output_form: p0_6_p0_5_remainder_risk_review_note_r2

End of P0-6 + P0-5-remainder risk review note (r2, A-1 resolved).