---

title: 09 — Phantom Definition + Law Patch Pack (Branch G) date: 2026-05-31 status: LAW_DEFINITION_GAP — decision pack only, NO enactment (Đ32 council / RG4)

09 — Phantom Definition + Law Patch Pack (Branch G)

A. Final source_model-aware definition (recommended)

A phantom = a counted/registered unit whose backing substrate cannot be located by the authoritative scanner of its source_model, evaluated per model:

• model B (file/external): registered row with no backing file/artifact → phantom.
• model A (DB/Directus): only after reconciling the registered count vs the live pivot; a positive record − actual explained by scan-lag or in-flight writes is NOT phantom.
• pg_table / unmeasured: cannot be phantom until a scanner result exists. Phantom (substrate-absent) is distinct from orphan (missing birth/relationship, Đ19).

B. Why record_count > actual_count alone is UNSAFE — sharpened with THIS session's live evidence

The CAT-023 birth gap moved within a single session: +1 → +16 → +17 (record 985,472→985,488 as birth_registry wrote rows; actual lagged at 985,471). A blind record−actual rule would have reported a growing "phantom" that is purely a live-write race. Contrast the stable model-B cases:

row	model	record	actual	naive	TRUE
CAT-023 birth	A	985,488	985,471	"phantom +17 (and rising)"	live-write race — not phantom
CAT-006 dot_tools	B	309	163	"phantom +146"	genuine phantom (146 rows, no file)
CAT-007 ui_pages	B	37	52	"orphan −15"	15 unregistered files (not phantom)
The fluctuation is the proof: a model-A surplus is noise; only model-B substrate-absence is phantom.

C. Mapping to system_issues / event_outbox (Đ45)

• Detection → system_issues: issue_type='count_integrity_phantom', source='registries-pivot-count-integrity', entity_code=<CAT>, idempotent via coalesce_key='phantom:<cat>:<source_model>', occurrence_count/reopen_count track recurrence (mirrors existing dot-layer-integrity-audit source).
• Signal → event_outbox: NEW event types count_integrity.phantom_detected / phantom_cleared (register-before-emit; verified absent in event_type_registry today). MOT-not-executor (Đ45).

D. Cleanup workflow handoff

fn_count_integrity_check() scans the leaf set; for each model-B row with record>actual + missing-file signal, upserts a count_integrity_phantom issue → owner triages → confirm = soft-retire (Đ0 Atom) or re-onboard the file → phantom_cleared + issue resolved. Đ31 self-verification contract + watchdog ensure the check runs (silent-gap/heartbeat).

E. Proposed law-patch TEXT (DRAFT — council only, NOT enacted)

Điều [NN] — Phantom (Bóng ma đăng ký). A phantom is a counted/registered unit whose backing substrate cannot be located by the authoritative scanner of its source_model. Detection MUST be source_model-scoped: (a) model B = missing backing artifact; (b) model A = only after live-pivot reconciliation, and a surplus explained by scan-lag/in-flight writes is NOT phantom; (c) unmeasured = not classifiable. Blind record_count − actual_count MUST NOT be the phantom count. Phantom ≠ orphan (Đ19). Remediation = soft-retire (Đ0 Atom) or re-onboard. Detection writes idempotent system_issues and emits signal-only event_outbox events, both registered before first emit (Đ45).

F. Acceptance criteria (RG4)

Source_model-aware; blind record−actual rejected; phantom≠orphan boundary stated; count_integrity_phantom

• phantom_detected/cleared registered before emit; live test: CAT-006=phantom-candidate, CAT-023=NOT phantom (race), CAT-007=unregistered. Until ratified: render warning_flag=phantom(unconfirmed), emit nothing. No enactment by agent.