Branch C — Điều 35 / dot_tools SSOT Integration

Doc 03 (2026-05-29) — Plan only; dot_tools not mutated

1. Exact mismatch (live)

• dot_tools (constitutional Đ35 SSOT) has full schema: code, name, tier, domain, operation, paired_dot, trigger_type, cron_schedule, file_path, coverage_status, _dot_origin, … (309 rows).
• Only 2 IU rows exist there, and they are a correctly paired Đ35 dual-signature: DOT-IU-CUTTER (tier B, domain governance.audit) ↔ DOT-IU-CUTTER-VERIFY (tier A). So the P0 cut executor is constitutionally registered and paired.
• The other 52 IU operations live only in dot_iu_command_catalog (a separate table with command_name, category, mutating, reversible, target_functions, registered_at — no paired_dot, no Tier-A/B).

So: the IU operational DOT layer is functional and audited (via fn_dot_iu_command_log + dot_iu_command_run) but is not discoverable/governable through the Đ35 dot_tools SSOT, and lacks Tier-A pairing for all but the cutter.

2. Decision: which registry is canonical (no duplicate SoT)

• dot_iu_command_catalog = canonical IU operational SoT — it has the run-log binding (dot_iu_command_run), the fail-closed logger, and the target_functions mapping the agent actually uses.
• dot_tools = constitutional governance registry (Đ35) — coverage, pairing, ownership, cron.
• Do NOT duplicate command bodies into both. Bridge by reference.

3. Bridge plan (recommended: Option A — ratify sub-registry)

Option A (recommended): APR ratifying dot_iu_command_catalog as a recognised Đ35 sub-registry under the IU domain, plus a reconcile DOT (fn_dot_iu_tools_reconcile() + paired Tier-A) that asserts, for every catalog row: (a) it appears (or is represented) in dot_tools coverage, (b) every mutating=true catalog command has a Tier-A read companion (the paired_dot analogue), surfacing violations to system_issues (Đ31). This keeps one operational SoT and gives Đ35 governance visibility without copying bodies.

Option B (heavier): register a thin pointer row in dot_tools per IU command (tier inferred from mutating, paired_dot set, script_path→target fn, domain='iu.core'). Rejected for now because dot_tools is FK-guarded and has trg_dot_enforce_paired (a Tier-B with NULL paired_dot is rejected) — bulk insert would require authoring 52 Tier-A companions first, i.e. it presupposes Branch B M2.

4. Why no live mutation of dot_tools this session

dot_tools enforces paired-DOT at the trigger level and FK-validates reference tables. Inserting IU rows safely requires the Tier-A companions (Branch B M2) and an APR. Mutating the constitutional SSOT without that is out of safe scope. Plan delivered; execution belongs to a governed macro.

5. Sequencing

Branch B M2 (author the 7 mutating wrappers + Tier-A companions) → then Branch C Option A (ratify sub-registry + reconcile DOT) → optional Option B pointer rows. The cutter pair already demonstrates the target shape.