09 — Self-Review

Against completion criteria (mission §5)

#	Criterion	Met?	Note
1	State recovery complete	✅	doc 01, live-verified
2	Live preflight complete	✅	Gate 0 all checks
3	Mapping view applied or blocked w/ evidence	✅	APPLIED, doc 02
4	Cleanup plan covers all cases	✅	doc 03, 37/37 rows
5	Đ26/DOT cleanup path explicit	✅	doc 04
6	Verification suite produced	✅	doc 05, V1–V10 passing
7	UI/API contract produced	✅	doc 06
8	Next implementation plan produced	✅	doc 07
9	KB package published/readable	✅	00–09
10	No forbidden action occurred	✅	doc 08 checklist

⇒ PASS (not PARTIAL: both view applied AND cleanup path complete).

What changed vs the predecessor (RP-attach package)

• Predecessor left the view paste-ready, unexecuted ("0 prod mutations"). This macro, on explicit user authorization, applied it — the first deliberate, single, inert read-only DDL on prod in this project line. The 0-mutation-of-base-data invariant is preserved (only a derived view object added; base fingerprint unchanged).

Decisions I made and why

1. Asked before applying. Production DDL against a project whose entire history is "byte-unchanged / owner-go" is a genuinely user-owned call. User chose Apply (twice, with an explicit protocol). Correct to ask.
2. Fail-closed guarded transaction. Apply could not commit unless rows=37/orphan=0/domain=15/shape=22 — so a schema surprise would abort with zero residue.
3. Refined the composition taxonomy beyond the brief: distinguished real mismatch (3, governed-home bugs) from drill_overload (9, intentional RP-local drill). Grounded in Đ26 td-matrix-dimensions (composition ladder legitimately includes building/material/product). This avoids mislabeling law-valid drill values as "dirty garbage".
4. No BEGIN..ROLLBACK UPDATE rehearsal. It would model the Đ26-forbidden manual path and fire side-effect triggers. Substituted a read-only target-state preview + DOT packet.

Honest limitations / residual uncertainty

• DOT arg schema not byte-confirmed. The DOT packet (doc 04) is at intent level; the operator must bind pivot_code+field to the actual dot-pivot-declare CLI args (I did not read dot/bin/dot-pivot-declare). Flagged, not hidden.
• Action B targets are proposals, not decisions. FAC-02 may need a new "Quy trình" label; that is a council call. I did not pick on their behalf.
• pivot_kind collapses matrix_l1/matrix_l2 → 'matrix'. Intentional (both are matrix shapes); the L1/L2 distinction survives in raw_registry_group.
• View composition_status treats default-bucketed rows as candidates for mismatch (not drill_overload), because default = domain-unassigned governance-home, not a true RP-local shape. This is a judgment call, documented; it is why mismatch=3 (incl PIV-016/021) rather than folding them into drill.

Confidence

High on the applied view, the entry==exit proof, and the row-level classification (all live-verified). Medium on the exact DOT CLI binding and the Action-B label choices (correctly deferred to owner/council).