12 — Final Summary

PARTIAL — birth explosion CONTAINED, policy enforcement APPLIED, RP object hygiene guarded; trigger reconciliation STAGED.

Codex root cause reverified live (not contradicted): the 10:00 UTC dot-hc-executor → H11a heal_description_basic → recursive anti-loop on system_issues + entity_labels auto-labels → fn_birth_registry_auto produced exactly +5,195 births (this_hour=5,195). No active runaway; the run completed at 10:01.

Three fixes applied live (reversible, fail-closed, birth-neutral)

1. B H11a → detect_only / auto_fix_action=NULL (config row) — stops the heal cascade; the 13:00 cycle cannot reproduce the spike.
2. C fn_log_issue semantic idempotency — repeats coalesce (occurrence_count++, no new row → no birth). Proven: 3 calls → 1 row.
3. D fn_birth_registry_auto skips BIRTH_EXEMPT% — entity_labels/registry_changelog can no longer birth. Proven: 0 births on exempt insert.

Defense in depth: B stops the source, C stops duplicates from any check, D stops exempt births structurally.

RP object hygiene

1,210,724 raw births = 98.97% noise. True managed objects = 2,926 (+6,582 provenance). Clean-count contract + pollution surface ready for RP to bind.

Staged (owner/migration authority)

E trigger reconciliation (29 exempt + 18 duplicate + 50 deferred + 5 missing), DEFERRED reclassification, optional partial unique index, RP UI repoint.

Safety

0 row deletions, 0 trigger disables, executor running, before==after 1,210,724, rollback staged, OOM safe.

Next macro

BIRTH_TRIGGER_RECONCILIATION_MIGRATION → RP_OBJECT_HYGIENE_UI_UPDATE_AND_FINAL_ACCEPTANCE. Verify the 13:00 UTC cycle first.