63 — T6/T7 Patch Rehearsal Results (R-7)

Doc: 63. Role: Live rehearsal of the 10 GCOS build addenda (doc 45 §45.4). Executes doc 48 Prompt 6. Part A = PG additive-row rehearsal (BEGIN..ROLLBACK); Part B = KB doc-patch DIFF ONLY (docs 24/25 NOT written). Status: REHEARSAL RESULT — PASS. ZERO COMMIT, no DOT registered, no event activated, no write to docs 24/25, entry==exit proven. T6/T7 build NO-GO. Date: 2026-06-01. Entry baseline: doc 57.

---

63.1 Part A — additive-row rehearsal (BEGIN..ROLLBACK)

Rehearsed addenda #4 (4 GCOS DOTs in dot_tools) + #5 (dot_coverage_required governance rows). Two live findings forced a corrected approach — the value of running it live:

• F-R7-1 — dot_coverage_required.domain has FK → dot_domains(code). The first attempt failed: Key (domain)=(governance.backfill) is not present in dot_domains. dot_domains has governance, governance.approval, governance.audit but not the 4 GCOS subdomains. Corrected: register governance.{backfill,handoff,input,candidate} in dot_domains first (additive, parent=governance), then the coverage rows. Build addendum #5 must include a dot_domains insert step.
• F-R7-2 — dot_tools Birth-Gate code-format trigger. Codes dot_governance_* raise WARNING: Birth Gate [dot_tools]: Code format PREFIX-NNN … sai format — a warning, non-blocking (the INSERTs succeeded). Build decision needed: either adopt PREFIX-NNN codes (e.g. GOVDOT-001) or accept the warning. Recorded as open item.

The aborted first attempt (before the corrected one) left zero residue — dot_tools=309, dot_coverage_required=11 unchanged — proving even an erroring rehearsal rolls back fully without COMMIT.

Corrected Part A transcript (verbatim, condensed)

===R7A2_PRE===  dom_total=46 dot_total=309 dot_gov=0 cov_total=11
BEGIN SET SET SET
 INSERT 0 4   (dot_domains: governance.backfill/handoff/input/candidate)
 INSERT 0 4   (dot_tools: 4 GCOS DOTs, tier A read/propose)   [Birth-Gate WARNINGs x4, non-blocking]
 INSERT 0 4   (dot_coverage_required: 4 rows referencing new domains)
===R7A2_INTX_COUNTS===  dom_total=50 | dot_gov=4 | cov_gcos=6
===R7A2_INTX_DOTS_TIER_A_NO_MUTATING_APPLY===
 dot_governance_backfill_sweep | A | read/propose
 dot_governance_candidate_scan | A | read/propose
 dot_governance_handoff_intake | A | read/propose
 dot_governance_input_gate     | A | read/propose
ROLLBACK
===R7A2_POST===  dom_total=46 dot_total=309 dot_gov=0 cov_total=11 dom_gcos=0

Separate-session query_pg after ROLLBACK: dot_domains=46, dot_tools=309, gov DOTs=0, dot_coverage_required=11, GCOS domains=0. All 4 GCOS DOTs are tier-A read/propose — the only mutating DOT (dot_governance_assignment_apply) was not created (G-APPLY NO-GO). No event activated (active=false, per R-5).

63.2 Part B — the 10 build addenda (doc-patch DIFF ONLY; docs 24/25 NOT written)

Count PINNED at 10 (doc 45 §45.4). Doc 35 §7's "eleven" is documentation drift OI-45-1 (the production-gate is the 10th in-table row, not a separate +1). Diffs produced for a future T6/T7 build macro — not applied:

#	Target	Patch (summary)
1	T6 §4 L1 (Inventory)	Add pre-stage L0 = input-quality gate (doc 33); L1 enumerates the dirty + stale-expired candidate set from SB-10 (not full enumeration of 1.04M+); full scan only at periodic-full-audit + initial backfill.
2	T6 §4 L2 (Birth precedence)	Pre-enforced by input-gate state birth_or_registry_missing; retain L2 as defense-in-depth.
3	T6 §5 lifecycle	Insert GCOS pre-stages HANDOFF-INTAKE → INPUT-GATE → CANDIDATE-SCAN → [SCAN/DETECT…]; SCAN reads the candidate working set.
4	T6 §6 DOT family	Add 4 GCOS DOTs (dot_governance_backfill_sweep/_handoff_intake/_input_gate/_candidate_scan) — rehearsed Part A (note F-R7-2 code-format).
5	T6 §9 dot_coverage_required	Add governance.{candidate,backfill,handoff,input} rows (A-tier) — rehearsed Part A (note F-R7-1: register dot_domains codes first).
6	T7 §5 issue table (20 types)	Add 19 new finding types (4 backfill + 4 handoff + 7 input-quality + 4 candidate) riding existing system_issues buckets + governance domain.
7	T7 §6 anti-spam	Add coalesce dimension group_key (doc 34 §3) + group_invalidation_storm ceiling.
8	T7 §9 auto-close	Re-key auto-close by (coalesce_key, ruleset_version) (RR-7) so a close under an old ruleset can't mask a needed re-open.
9	T7 §2 / Điều 45	Register GCOS event types under one governance domain (backfill.*/handoff.*/input.*/candidate.*/coverage.*) — rehearsed R-5 (active=false).
10	Production gate (concept §11)	Candidate status stale/unknown for a high-risk object ⇒ G-PROD blocks (fail-closed); low-risk ⇒ scheduled re-scan.

Docs 24/25 were NOT modified — the only change to them remains the doc-45 §45.9 non-semantic cross-ref headers (retained, RR-12). No Nuxt/API/route change; no production code.

63.3 Entry==Exit

dot_domains=46, dot_tools=309, gov DOTs=0, dot_coverage_required=11, GCOS domains=0, governance events active=0 — all identical to entry. ✅

63.4 Verdict

R-7 = PASS. 10 addenda enumerated (count pinned); Part-A additive rows rehearsed then rolled back; Part-B diffs produced but not written. Two real build dependencies surfaced (F-R7-1 dot_domains FK, F-R7-2 Birth-Gate code format) — both must be folded into addenda #4/#5 at build time. No DOT registered, no event activated, no emit, no COMMIT. T6/T7 build NO-GO (gated on SB-10/11/12/13 built + C-7 + gate table + M-1).