01 — Candidate Registry Governed Foundation (Branch A)

Verdict: DESIGN + IMPLEMENTATION-READY-DDL + AUTHORITY PACK. Live create of new registry tables is correctly deferred — each new registry is itself a governed collection that must be born under Đ0-G birth_registry + Đ36 collection_registry + Đ29 4-attr + Đ32 approval. Self-minting registry tables without that contract would itself be "đẻ rơi" (orphan birth). What advances here: a per-target reuse/extend/create decision, owner law, birth/collection/species/governance contract, ready DDL, rollback, no-double-ownership proof, and the Mother dependency.

Live confirmation (entry)

to_regclass → ABSENT: field_registry, input_form_registry, tier_registry, output_table_registry, dot_function_registry, task_template_registry. De-facto hosts PRESENT: table_registry(21), collection_registry(168), dot_iu_command_catalog(52 ≈ dot_function registry), workflows(2), tasks(10), design_templates(1), governance_registry(5), species_collection_map, governance_relations.

Decision matrix (8 targets)

#	Target	Decision	Host / new table	Owner law	Mother dep
1	field_registry	CREATE (minimal)	new field_registry	Đ36 (collection-of-fields) + Đ29	MOW/MOT forms
2	input_form_registry	CREATE (minimal)	new input_form_registry	Đ28 (template) + Đ36	MOW input UI
3	tier_registry	CREATE (minimal)	new tier_registry	Đ37 (governance tiers)	all 4 Mothers
4	output_table registry	REUSE	table_registry(21)	Đ36	MOT/MOIT outputs
5	dot_function registry	REUSE	dot_iu_command_catalog(52)	Đ35 (DOT)	all DOT-driven
6	workflow template	REUSE/EXTEND	workflows(2)	Đ7 (assembly)	MOW
7	task template	REUSE/EXTEND	tasks(10) + os_project_templates	Đ7	MOW/MOT
8	ui_product template	REUSE	design_templates(1)	Đ28 (Nuxt/template)	all UI surfaces

Reuse 5 / Create 3. Matches prior superbundle's 5/8-reuse finding (live-stable).

No-double-ownership proof

• Reused hosts already carry a single Đ-owner (table_registry→Đ36, catalog→Đ35, workflows/tasks→Đ7, design_templates→Đ28). Registering a candidate-registry role on top is a view/label, not a second SoT — no row is owned twice.
• The 3 new registries each get exactly one created_by_law + one primary_collection; they do not shadow an existing registry's rows.
• Đ31 integrity: new registries reference (FK) existing SoT, never copy it.

Implementation-ready DDL (authority-gated; DO NOT apply without birth-contract + Đ32)

-- 1. field_registry  (Đ36 collection-of-fields; owner law Đ36)
CREATE TABLE field_registry (
  code              text PRIMARY KEY,
  collection_code   text NOT NULL REFERENCES collection_registry(code),
  field_name        text NOT NULL,
  data_type         text NOT NULL,
  is_required       boolean NOT NULL DEFAULT false,
  interface         text,                       -- Directus interface hint
  validation        jsonb,
  created_by_law    text NOT NULL DEFAULT 'Dieu36',
  birth_ref         bigint REFERENCES birth_registry(id),
  status            text NOT NULL DEFAULT 'draft',
  created_at        timestamptz NOT NULL DEFAULT now(),
  UNIQUE (collection_code, field_name)
);
-- 2. input_form_registry  (Đ28 template + Đ36)
CREATE TABLE input_form_registry (
  code              text PRIMARY KEY,
  design_template   text REFERENCES design_templates(code),  -- Đ28 binding
  target_collection text NOT NULL REFERENCES collection_registry(code),
  field_set         jsonb NOT NULL,             -- ordered field_registry codes
  governance_role   text,
  created_by_law    text NOT NULL DEFAULT 'Dieu28',
  birth_ref         bigint REFERENCES birth_registry(id),
  status            text NOT NULL DEFAULT 'draft',
  created_at        timestamptz NOT NULL DEFAULT now()
);
-- 3. tier_registry  (Đ37 governance tiers)
CREATE TABLE tier_registry (
  code              text PRIMARY KEY,
  tier_level        int  NOT NULL,
  name              text NOT NULL,
  scope             text NOT NULL,              -- e.g. unit/collection/system
  authority_role    text,                       -- maps to governance_registry.code
  created_by_law    text NOT NULL DEFAULT 'Dieu37',
  status            text NOT NULL DEFAULT 'draft',
  created_at        timestamptz NOT NULL DEFAULT now(),
  UNIQUE (tier_level, scope)
);

Rollback: DROP TABLE IF EXISTS field_registry, input_form_registry, tier_registry CASCADE; (all draft, zero downstream rows at birth).

Birth / collection / species / governance contract (each new registry)

1. birth_registry row (Đ0-G) — industrial birth, no đẻ rơi.
2. collection_registry row (Đ36) — the registry IS a collection.
3. species_collection_map row (Đ29 4-attr: composition_level, governance_role, species, owner).
4. governance_registry linkage (Đ37) — owning system agency (e.g. GOV-DOT for dot_function, a new GOV-FIELD-SYS for field_registry, or fold under GOV-SIV).
5. Đ32 approval artifact (council/human) before COMMIT.

Reuse-host registration (SAFE-NOW path, still authority-gated)

For the 5 reuse targets, no DDL — register a candidate-registry role marker (e.g. a dot_config key candidate_registry.output_table=table_registry) so future Mothers resolve registries deterministically. Authority: Đ35/Đ36 config; reversible (delete key). Deferred to CR-birth macro to keep this bundle zero-DDL.

Mother dependency summary

• G1 gate (CR-birth) is the binding blocker for all 4 Mothers. The 3 CREATE registries + 5 reuse-role markers must exist before MOW/MOT/MOIT/MOUT can resolve field/form/tier/output/function/workflow/task/ui targets.
• This bundle delivers everything except the COMMIT — that COMMIT is the next macro (doc 10 Prompt 1).

Advance vs prior state

Prior bundles only mapped reuse and named absence. This doc adds: ready CREATE DDL with FK to birth_registry/collection_registry/design_templates, explicit rollback, no-double-ownership proof, the 5-step birth contract per registry, and the reuse-role config path — i.e. CR is now build-ready pending one approval, not merely surveyed.