D1-supp2 — KG Curated Cluster companion: endpoint feasibility + verifier correctness

Companion to d1-knowledge-graph-curated-cluster-2026-06-04.md and d1-supp-kg-explain-pilot-and-discovery-status-2026-06-04.md. No source IU/document edited. Derived doc; extends D1 with this run's findings.

1. The EXPLAIN pilot is now buildable on existing infra

Earlier framing: the EXPLAIN producer was blocked by "no LLM credential + no hosting". Live evidence (2026-06-04) corrects this: the VPS already has an OpenAI credential (in incomex-agent-data), the openai SDK, and working egress to api.openai.com. So the curated KG cluster's canonical dry-run shape — explain kgn:dieu39 over its 4-node subgraph — is implementable as a small no-mutation service (now staged). The KG cluster is the reference fixture for that service.

2. The fixture as the canonical KG dry-run shape

FIXTURE:dot:kg:explain:v1 mirrors the curated cluster: target kgn:dieu39 (Điều 39 — KG Law), nodes {dieu39, dot_kg_family, explain_pair, provenance}, edges GOVERNS / CONTAINS / CONTAINS / DEPENDS_ON. This is the smallest grounded subgraph that exercises: target-reference, no-hallucination, edge-existence, and no-production-table — the four KG explanation safety properties.

3. Verifier correctness — a real lesson

The deterministic verifier had a latent failure-path bug: it could confirm a GOOD explanation (pass path) but crashed when asked to reject a BAD one (untyped-literal array append). A verifier that cannot fail is not a verifier. Fixed this run; all four negative controls now reject correctly (hallucinated node, missing target, production-table reference, missing target+ref). Lesson for the KG family: every EXPLAIN/VERIFY pair must be tested on its negative path, not only its happy path, before it is trusted as a gate.

4. The 36-DOT / 18-pair correction (carried)

The dot-kg family has 36 DOTs in 18 producer/verifier pairs. The earlier "18 orphaned producers" reading was a fixed inventory-filter bug (on-demand producers dropped). The curated cluster's EXPLAIN pair is one of the 18.

5. job:cut contrast (why dot:kg is not yet verified)

job:cut reached verified_candidate because it has correlated REAL_RUN rows (job_queue.run_id). dot:kg has none yet — no endpoint, no correlation, no real run. The KG family's path to verified runs strictly through: deploy endpoint → bind → dry-run → correlation → real run.

6. Operational lesson

The KG explanation capability is gated less by modeling and more by a small piece of runnable no-mutation infrastructure plus a working negative test. Both now exist (service staged; verifier fixed).