04 — dot-pivot-update vs Existing-Tool Path

Cleanup = UPDATE composition_level on 3 born rows (PIV-001 molecule→atom, PIV-016 atom→meta, PIV-021 atom→molecule). matrix_spec excluded.

Path 1 — register/birth dot-pivot-update

Required: registrar creds (dot-dot-register, Directus-API), dot_tools row, birth row, governance status, dry-run. dot-dot-register creds ABSENT → BLOCKED_EXTERNAL_AUTHORITY. Manual dot_tools INSERT + token mint is forbidden (ungoverned false-clean birth).

Path 2 — existing valid DOT substitute (all 8 live, published)

DOT-113 dot-pivot-declare = INSERT-only → No. DOT-114 dot-pivot-health = read-only → No. DOT-307 dot-pivot-virtual-create = create → No. DOT-308 dot-cron-pivot-setup = cron → No. DOT-312 dot-matrix-declare = INSERT → No. DOT-313 dot-matrix-update = matrix_spec/name only → No. DOT-314 dot-matrix-retire = is_active=false → No. DOT-315 dot-matrix-health = read-only → No. No registered/born DOT can UPDATE composition_level/species/registry_group on an existing pivot_definitions row — exactly the gap dot-pivot-update was authored to fill. Substitute path = NOT AVAILABLE. (Re-declare-then-retire rejected: INSERT-only dup-guard self-blocks and breaks pivot identity.)

Path 3 — no DOT mutation needed now

RP view live and correctly reports 3 mismatch / 21 match / 9 drill_overload (law-valid) / 4 no_ref. The 3 mismatches are classification-accuracy flags on born, governance-attached rows; they do not block IU work; the view already exposes the correct governed composition. Resuming RP/IU work does not require mutating them now; the fix is deferred cleanup.

Decision

• RP cleanup: Path 1 eventual, currently BLOCKED_EXTERNAL_AUTHORITY (creds); Path 2 unavailable.
• RP/IU work: Path 3 — resume now; defer the 3 fixes until tool is born. Exact next action: obtain dot-dot-register creds → register+birth dot-pivot-update → its authored --auto-from-species dry-run + --commit closes the 3 mismatches.

Forbidden lines honored

Not executed; not registered without full lawful path; no manual psql RP UPDATE; file-only script not called a valid DOT.