06 — DOT Governance Cross-Check

Mission §4 DOT objects, verified live + against Đ35 v5.2 wording and the S178 origin report.

Catalogs (live)

• dot_tools (309) — tier A=60 / B=230 / null=19; paired_dot=131/309 (178 unpaired); operation=50/309 (259 null); coverage_status null=103/309; status active=291 / published=16 / null=2. All re-verified exact vs first pass.
• dot_iu_command_catalog (54) — IU-DOT command catalog; first pass: 100% metadata, mutating 39 / reversible 41, no schema/test/paired column. (Not re-counted by sub-field this pass; structure claim accepted — confidence carried.)
• dot_operations (20), dot_domains (46), dot_domain_rules (67), dot_coverage_required (11), dot_config. Counts verified.

Đ35 wording verification (mission §3 D35)

• KB dieu35-dot-governance-law.md = v5.2 FINAL, BAN HÀNH 2026-04-18, "S178 Fix 15" — confirmed enacted; NRM NRM-LAW-35-V5P2 (base NRM-LAW-35 v5.1 retired). Đ35 §11 = paired-test retrofit + 3-tier verify + ADMIN fallback audit + APR linkage. The first pass's "Đ35 §11 paired-test retrofit for 178 unpaired" is the correct governance channel — verified against the live law title and the S178 Council review (9.2/10, APPROVE WITH CHANGES).
• fix_repair_dot is a real approval_requests type (first-pass doc 04) and originates from the S178 DOT Repair Governance package. So the retrofit is not ad-hoc — it has an enacted flow.

Dual-count (sharper than first pass)

• CAT-006 = 309 (dot_tool), CAT-DOT = 307 (dot_total, orphan 140). The two refresh paths (refresh_meta_catalog_from_pivot→CAT-006 via PIV-007 vs fn_refresh_dot_count/fn_refresh_orphan_dot→CAT-DOT) produce different totals (309 vs 307). RECONCILE to one canonical CAT. This is the concrete "two truths for one table" risk.

Scanners (Đ23 tam quyền)

• KB dot-scanning-system.md (rev 4) = Đ23 "TAM QUYỀN PHÂN LẬP DỮ LIỆU" (LÀM / KIỂM TRA / GIÁM SÁT). Confirmed in KB; absent from normative_registry (doc 03/04). Live scanner fns named by first pass (fn_refresh_orphan_dot, fn_birth_onboarding_full_scan, fn_validate_dot_origin, fn_enforcement_validate_dot) — accepted; not all bodies read (carried 0.90 confidence).

Quality gaps (verified, unchanged)

• operation 50/309, coverage_status 103 null, tier 19 null, paired 131/309 — all live-confirmed. → REUSE the existing dot-metadata-fill DOT to fill (do NOT rebuild); → EXTEND Đ35 §11 paired-test retrofit for 178 unpaired (governed). → WRAP dot_iu_command_catalog with a test/paired view (no new table) if IU-DOT test tracking is wanted.

Anti-forgetting addition

The first pass did not cite S178 (DOT Repair Governance) or S164 (Đ38 14 normative DOTs, total 265→309) as the provenance of the current DOT governance + count. Logging them here ensures the paired-test/fix_repair_dot retrofit is recognized as executing an already-enacted Đ35 v5.2 program, not inventing one.

Verdict

DOT governance: VERIFIED LIVE, REUSE + retrofit under Đ35 v5.2. No missing DOT capability that needs a new engine. Concrete actions are quality fills + the canonical-CAT reconcile + paired-test retrofit — all reuse paths.