04 — Đ26/DOT-Compliant Cleanup Path

The law: manual UPDATE is FORBIDDEN

Đ26 Pivot Law v4.0 §II-QUINQUIES — "KHÔNG INSERT tay" (no manual insert/update). Pivot definitions are declared/updated via DOT and refreshed by cron + PG trigger. Two independent reasons this is mandatory here:

1. Legal: Đ26 binds all pivot mutation to the DOT path.
2. Technical (write-path risk): pivot_definitions has 3 enabled triggers — trg_pivot_def_refresh (refresh), fn_birth_registry_auto (writes birth_registry), fn_matrix_config_changed (matrix events). A manual UPDATE would fire all three with uncontrolled side effects. The DOT path is the sanctioned way to mutate with the side effects handled correctly.

⇒ No UPDATE pivot_definitions … is issued by this macro, and none should be issued manually. Cleanup = DOT packet, executed by the owner/operator at owner-go.

Lawful tools (live, dot_tools domain=pivot, all published)

DOT	Name	Use for
DOT-113	dot-pivot-declare	Re-declare a pivot with corrected composition_level / species / registry_group (Actions A + B)
DOT-313	dot-matrix-update	Update matrix-type pivot definitions (MTX rows, if needed)
DOT-314	dot-matrix-retire	Retire MTX-TEST (Action D)
DOT-114 / DOT-315	dot-pivot-health / dot-matrix-health	Post-cleanup verification

L1-side governed vocabulary (if a new FAC-02 label is decided in Action B): classification.label domain (5 DOTs) and classification.species domain (3 DOTs).

Approval & rollback

• These DOTs are published; execution requires the DOT runner (out-of-DB, owner-operated). This macro does not execute them (forbidden: DOT execution without explicit owner go).
• Several pivot DOTs carry a paired_dot (rollback counterpart) in dot_tools; the operator pairs each declare with its inverse, or re-declares prior values. Prior values are preserved in this report + the entry fingerprint md5=5a060f5460c3d9e02c4a6754cdee4fcc.

DOT packet (intent — operator binds to the DOT CLI arg schema)

Each line = one dot-pivot-declare invocation. Field shown is the only field to change; all other fields keep current values. Bind pivot_code + field to the actual dot-pivot-declare arguments (confirm via dot/bin/dot-pivot-declare --help).

Action A — composition safe-fix (3):

dot-pivot-declare  PIV-001  composition_level=atom      # catalog is governed atom (was molecule)
dot-pivot-declare  PIV-016  composition_level=meta      # species/SPE-SPE is governed meta (was atom)
dot-pivot-declare  PIV-021  composition_level=molecule  # checkpoint_support is governed molecule (was atom)

Action D — retire (2):

dot-pivot-declare  PIV-020  is_active=false  status=retired   # _uncategorized placeholder (already inactive)
dot-matrix-retire  MTX-TEST                                   # inactive test fixture

Action B — domain assignment (12) — REQUIRES NAMING DECISION FIRST (human/council): The 6 default-bucketed governance-home pivots + 6 provisional domain pivots have no exact FAC-02 label today. Proposed targets for ratification (do not auto-apply):

pivot_code	species	proposed FAC-02	rationale
PIV-015/017/018/019	governance_infra	LBL-105 Giám sát	monitoring/governance infra
PIV-016	species (meta)	LBL-101 Cấu trúc	structural meta-registry
PIV-021	checkpoint_support	LBL-103 Quy tắc or LBL-105	rule/monitoring support
PIV-004/005/006	workflow/step/wcr	LBL-104 Công cụ or new "Quy trình" label	process automation
PIV-012/013	checkpoint_type/set	LBL-103 Quy tắc	rule definitions
PIV-010	task	LBL-102 Nội dung or LBL-104	work-item content

If the council decides the FAC-02 vocabulary is insufficient (e.g. needs a "Quy trình"/process label), that is an L1 governed-vocabulary change via the classification.label DOTs — still no manual UPDATE.

Then for each ratified decision:

dot-pivot-declare  <pivot_code>  registry_group=<governed_domain_token>

Read-only target-state preview (no UPDATE modeled)

This query shows the desired governed values per actionable row, computed from governed truth — purely diagnostic, mutates nothing. Use it to review the DOT packet before execution:

SELECT m.pivot_code, m.raw_species AS species,
       m.raw_composition_level   AS current_comp,
       m.species_governed_composition AS target_comp,
       m.composition_status,
       m.raw_registry_group      AS current_group,
       m.registry_group_kind, m.fac02_label_code, m.classification_lane
FROM v_rp_classification_governance_map m
WHERE m.composition_status = 'mismatch'         -- Action A (3)
   OR m.classification_lane = 'inactive_retire_candidate'  -- Action D (2)
   OR (m.registry_group_kind = 'pivot_shape' AND m.species_status IN ('clean','ambiguous_meta')
       AND m.raw_registry_group = 'default')     -- Action B default-bucketed gov-home (6)
ORDER BY m.composition_status DESC, m.pivot_code;

A BEGIN..ROLLBACK rehearsal of UPDATEs is deliberately NOT provided — it would model the Đ26-forbidden manual path and would fire the 3 side-effect triggers inside the transaction. The lawful artifact is the DOT packet above plus this read-only preview.