P9 G6 — Execution Log Run 4 — 2026-04-28

Phiên: S184 Ngày: 2026-04-28 Agent: Claude Code (Opus 4.7, xhigh effort) Bám: P9-G6-execution-prompt.md v0.2 OFFICIAL + P9-G6-precedence-errata.md + Wrapper v0.6 (PF-07 v0.5) Authorize chain: GPT R23 PASS (backup restored) · GPT R24 PASS w/ patches · User authorize: GO Status: PASS — 15/15 PASS criteria met, 0 residue, production untouched Cross-link:

Run #1: p9-g6-execution-log-2026-04-27.md — FAIL PF-Pre.2

Run #2: p9-g6-execution-log-run2-2026-04-27.md — FAIL PF-07

Run #3: p9-g6-execution-log-run3-2026-04-28.md — FAIL DDL trigger guard

Repair: p9-g6-trigger-guard-repair-option-a-log-2026-04-28.md — guard repaired, unblocked run #4

0. Run metadata

Field	Value
RUN_START_TS	2026-04-28 04:11:21+00 UTC
Host	`vmi3080463` (VPS, root)
Connection	`docker exec -i postgres psql -U directus -d directus -v ON_ERROR_STOP=1 -X`
PG version	16.13 (Debian 16.13-1.pgdg13+1) — server_version_num=160013
Docker container	`postgres` (image: postgres:16, health: healthy)
Workspace	`/tmp/g6_run4_20260428_041121/`
DDL bundle path	`${WORKSPACE}/ddl/g6_execution_bundle.sql`
DDL bundle SHA-256	`c23987f29911e92d43d9ab6cb5e4fe77d64547785d98588859dfcc6f02997cad`
Bundle size	23,528 bytes / 566 lines
Seed manifest	`knowledge/dev/laws/dieu38-trien-khai/seed-manifest-g6-expected.json`
Manifest hash_status	PENDING_COMPUTE — first-run mode, computed hashes recorded below for Opus update
Connection actor	`current_user=directus`, `current_database=directus`, `can_create_schema=true`
Backup file	`/opt/incomex/backups/pg/directus_2026-04-28_0000.sql.gz` (44,839,530 bytes / 4h old / gzip valid / PG dump header present)

0.1 Computed seed SHA-256 (8 files, raw `sha256sum` output)

1f707c4d23901990462c0ad2121849e0cc58bd07b32f9802630e571c9bc09cc3  seed/seed-tac-birth-gate-config.sql
f3860099c55f5c848525ac35e78410735401bc7b75a8a2cc50cbf8b1f7a3b793  seed/seed-tac-cs-lifecycle.sql
f71158717a05d8edacf79ba7574f6b9afecfb89691eb2b6933a8e14e4af31dac  seed/seed-tac-lu-lifecycle.sql
1c928c993f66cc68fd8d7252328916fd1eb71b8d9380b693489c63564daf923e  seed/seed-tac-pub-lifecycle.sql
4b9f27937009ebc705bf09aa9b37dac372506a3e6f9173f72310be690f53774c  seed/seed-tac-publication-type.sql
9412966e89253caa11ca52217578b2b45599987cc908218d00fa965619b2bd57  seed/seed-tac-review-state.sql
d5a3d167572e087ab38a31629b42bdb21a2e41088c1129d01ede3fcce08b77d4  seed/seed-tac-section-type.sql
4f7b9682e1d5b8a0bd3540f9b2ffcfa9f6a7628f6e166547d1bad26529f2e573  seed/seed-tac-uv-lifecycle.sql
c23987f29911e92d43d9ab6cb5e4fe77d64547785d98588859dfcc6f02997cad  ddl/g6_execution_bundle.sql

Action: Opus update seed-manifest-g6-expected.json hash_status to "COMPUTED" and replace each file's sha256 field with the value above. Subsequent runs verify hash match per prompt §7.4 step 3.

0.2 Mandatory verbatim quotes (prompt §1 self-evidence)

Package §5.5 D4 (NOTE v0.2 GPT R1#1):

"NOTE (v0.2 GPT R1#1): Partial index on enacted publications optimization DEFERRED. Rationale: PG không cho subquery trong WHERE của partial index predicate. Enacted lock được enforce bằng trigger fn_tac_pm_enacted_lock (§6.6), không cần partial index."
Package §6.7 (Dependency note):
"KHÔNG cần pgcrypto extension. Tất cả function dùng built-in:
- pg_catalog.sha256(bytea) — PG 11+, built-in
- pg_catalog.convert_to(text, encoding) — built-in"
Package §10 HE-08:

"HE-08 | KHÔNG INSERT dot_action_log (v0.2 GPT R1#3) | Production audit table; default G6 chỉ KB markdown + local artifacts"
Errata §1 Precedence rule:

"Cho execution G6, prompt v0.2 SUPERSEDES package v0.2 nếu có xung đột wording về quy trình thực thi."

0.3 5-GATE + Assembly Gate answers (prompt §2)

Gate	Trả lời
G1 Read 5 docs	Read full: `P9-G6-execution-prompt.md` v0.2 (51,379 chars), `P9-G6-precedence-errata.md` (3,189 chars), `P9-G6-dry-run-package.md` v0.2 §5/§6/§7/§8/§9/§10/§15, `P9-G6-source-extraction-note.md` v0.1, `tham-khao/handoff-s183-e-r3-e7-e6.md`, `gpt-review-g6-execution-prompt-r4-2026-04-27.md`. 8 seed files + manifest.
G2 COUNT before WHERE	14 tables, 6 functions, 6 triggers, 41 indexes (≥21), 61 seed rows, 11 PF (PF-Pre + PF-01→10 with PF-07 v0.5 wrapper override) + FAC/DOT cited from KB E5/E7.
G3 ≥3 cross-law check	Đ33 PG Law E1 exception OK (seed bootstrap inside isolated schema, no public tac_*); Đ24 Label Law: zero entity_labels/taxonomy_labels mutations; Đ35 DOT Law: zero dot_action_log writes (table doesn't exist in public on this VPS — V4-06 N/A → HE-08 vacuously holds).
G4 Schema-qualify	All DDL `p9_g6_dryrun.tac_`, all functions `p9_g6_dryrun.fn_tac_`, triggers reference `p9_g6_dryrun.tac_`, seed INSERTs into `p9_g6_dryrun.`. Verified by §7.3 grep tests 1–5 PASS.
G5 Ambiguity?	None. PF-01 errata understood: schema-exists-before-execution → STOP + report residue + escalate cleanup gate (HE-18). DROP CASCADE only allowed in §9 rollback of current run.

Assembly Gate (Đ-Assembly): PostgreSQL fully resolved (G6 = pure PG DDL/DML in isolated schema). Directus API not consulted live — wrapper override cites prior KB E5/E6/E7 evidence for FAC/DOT readiness (PF-04/PF-05).

1. PF-Pre results

#	Check	Result	Evidence
PF-Pre.1	Required CLI tools on VPS	PASS	docker, jq, sha256sum, gzip, awk, grep, find, file, tar — all present
PF-Pre.2	.env discovery (override: docker-exec credential)	N/A → PASS via override	Wrapper §A specifies `docker exec postgres psql -U directus -d directus`; no .env source needed on host
PF-Pre.3	Directus API + admin token (override: cite KB)	N/A → PASS via override	Wrapper §A: "Nếu Directus API/MCP unavailable, cite prior KB evidence: E5 PASS / E7 PASS / E6 PASS. Không reopen GSM/token."
PF-Pre.4	Seed manifest semantic (8 files, 61 rows)	PASS	manifest read: total_files=8, total_seed_rows=61, all 8 paths exist in KB, hash_status=PENDING_COMPUTE → first-run mode
PF-Pre.5	Workspace dirs created	PASS	`/tmp/g6_run4_20260428_041121/{preflight,ddl,verify,rollback,seed}`

2. Pre-flight results (Wrapper PF-07 v0.5 + prompt PF-01..PF-10)

#	Check	Result	Evidence
W1	Hostname is VPS	PASS	`vmi3080463`, Linux 6.8.0-90-generic, Apr 28 04:10 UTC 2026
W2	docker container `postgres` running	PASS	`State.Running=true`, image=postgres:16, health=healthy
W3	DB connectivity + identity	PASS	`current_user=directus`, `current_database=directus`
W4	CREATE SCHEMA privilege	PASS	`has_database_privilege(directus, directus, 'CREATE')=t` (rolcreatedb=f, rolsuper=f — privilege granted explicitly)
W5 / PF-01	Schema `p9_g6_dryrun` does NOT exist	PASS	`count=0` from `information_schema.schemata` — HE-18 honored, no auto-DROP
W6	8 KB canonical seed files readable	PASS	All 8 read via agent-data MCP, written to `${WORKSPACE}/seed/`, sha256 computed
W7 / PF-07 v0.5	Backup freshness	PASS	File: `/opt/incomex/backups/pg/directus_2026-04-28_0000.sql.gz`, age=4h (≤30h), size=44,839,530 bytes (≥1MB), gzip integrity=valid, header=`-- PostgreSQL database dump` present
PF-02	production `public.` clean of `tac_`	PASS	`total_violations=0` (tables/views/sequences/types/fn_tac_/trg_tac_)
PF-03	`pg_catalog.sha256(bytea)` + PG ≥11	PASS	`version_num=160013 (≥110000)`, `sha256_count=1`
PF-04	FAC-07/08/09 active (override: cite KB)	PASS	Wrapper override — E5 PASS in KB: FAC-07/08/09 created ids=[8,9,10]
PF-05	19 DOT-TAC-* active (override: cite KB)	PASS	Wrapper override — E7 PASS in KB: 19 DOT-TAC, ids 971–989
PF-06	`public.fn_tac_log_checker_issue` exists	PASS	1 row, `prosecdef=t` (SECURITY DEFINER), args=`(text,text,text,text,text DEFAULT NULL,jsonb DEFAULT NULL)`
PF-08	TRIGGER-GUARD informational	PASS (informational)	2 event triggers: `evt_trigger_guard_ddl` (ddl_command_end, fn_evt_trigger_guard) + `evt_trigger_guard_drop` (sql_drop, fn_evt_trigger_guard_drop). Both inspected — RAISE WARNING + INSERT trigger_guard_alerts only; non-blocking. Repair from `p9-g6-trigger-guard-repair-option-a-log-2026-04-28.md` confirmed effective (run #3 was blocked by old guard; run #4 unblocked).
PF-09	Identity + permission	PASS (consolidated with W3/W4)
PF-10	search_path baseline	PASS	`"$user", public` — overridden by `SET search_path TO p9_g6_dryrun, pg_catalog` in bundle

3. Execution phase

3.1 Schema bootstrap

DDL bundle file: ${WORKSPACE}/ddl/g6_execution_bundle.sql
DDL bundle SHA-256: c23987f29911e92d43d9ab6cb5e4fe77d64547785d98588859dfcc6f02997cad
Bundle structure: BEGIN → CREATE SCHEMA + COMMENT → SET search_path → 14 tables + indexes → 6 functions + 6 triggers → COMMIT (single transaction with \set ON_ERROR_STOP on)

3.2 §7.3 Grep tests on bundle + 8 seed files (5/5 PASS)

Test	Description	Result
1	No unqualified `tac_/fn_tac_/trg_tac_` DDL outside `p9_g6_dryrun.`	PASS (after refactor: CREATE TRIGGER reformatted to single-line so `ON p9_g6_dryrun.table` lives on same line as the trigger name match — fixes false-positive on multi-line CREATE TRIGGER)
2	No `CREATE EXTENSION` (HE-17)	PASS
3	No hardcoded `-U directus` in bundle/seeds (HE-14)	PASS
4	All seed `INSERT INTO` schema-qualified to `p9_g6_dryrun.*`	PASS
5	No `DROP SCHEMA p9_g6_dryrun` in execution bundle (rollback only in §9)	PASS (after refactor: COMMENT ON SCHEMA text rewritten so phrase "DROP SCHEMA p9_g6_dryrun" not present in bundle)

3.3 DDL phase

BEGIN → CREATE SCHEMA → 14 CREATE TABLE → 23 CREATE INDEX (explicit) → COMMIT
14 tables created in declared order: Group A (5 lifecycle vocab), B (2 type vocab), C (1 config), D (4 core), E (2 change-set)
41 indexes total (23 explicit + 18 PG-implicit on PK/UNIQUE) — exceeds package threshold ≥21
All 6 PG output CREATE TABLE per group
Single transaction COMMITted cleanly

3.4 Functions/triggers

6 CREATE FUNCTION (PL/pgSQL, all SECURITY DEFINER, all SET search_path = p9_g6_dryrun, pg_catalog)
6 CREATE TRIGGER attached to 4 tables
TRIGGER-GUARD (evt_trigger_guard_ddl) emitted 6 expected WARNING entries ([TRIGGER-GUARD] DDL detected: CREATE TRIGGER on trg_tac_*) and inserted 6 audit rows into public.trigger_guard_alerts (informational, expected — non-blocking)

3.5 Seed phase

All 8 seed files concatenated into seed/all_seeds.sql (sha256 1bc16c3a39488fde1318b8702d289e25464ce1842f6a930fc76b1949c7d323a4)
Wrapped in BEGIN/COMMIT, applied via psql -v ON_ERROR_STOP=1
Per-table INSERT 0 N confirms: 3+4+5+4+7+17+10+11 = 61 rows (V2-09 verified)

4. Verification results

4.1 Stage 1 — V1 Compile (V1-01 → V1-10)

V	Check	Expected	Actual	Match
V1-01	schema exists	1	1	OK
V1-02	14 tables	14	14	OK (all 14 expected names present)
V1-03	FK constraints	≥12	17	OK
V1-04	UNIQUE constraints	≥2	5	OK
V1-05	CHECK constraints	≥24	115	OK (PG 16 reports `NOT NULL` as CHECK in info_schema)
V1-06	indexes	≥21	41	OK
V1-07	6 functions	6	6	OK (`fn_tac_birth_gate_lu/uv`, `fn_tac_enacted_immut`, `fn_tac_pm_consistency`, `fn_tac_pm_enacted_lock`, `fn_tac_uv_compute_derived`)
V1-08	6 distinct triggers	6	6	OK
V1-09	all functions SECURITY DEFINER	all `prosecdef=t`	6/6 `t`	OK
V1-10	all functions search_path locked	`search_path=p9_g6_dryrun, pg_catalog`	6/6 match	OK

4.2 Stage 2 — V2 Seed (V2-01 → V2-09)

V	Table	Expected	Actual	Match
V2-01	tac_lu_lifecycle_vocab	3	3	OK
V2-02	tac_uv_lifecycle_vocab	4	4	OK
V2-03	tac_review_state_vocab	5	5	OK
V2-04	tac_pub_lifecycle_vocab	4	4	OK
V2-05	tac_cs_lifecycle_vocab	7	7	OK
V2-06	tac_section_type_vocab	17	17	OK
V2-07	tac_publication_type_vocab	10	10	OK
V2-08	tac_birth_gate_config	11	11	OK
V2-09	TOTAL	61	61	OK
V2-10	SHA-256 manifest match	PENDING_COMPUTE → recorded	recorded in §0.1	OK first-run mode

4.3 Stage 3 — V3 Constraint smoke (DO-block SQLSTATE harness)

V	Constraint type	Expected SQLSTATE	Actual SQLSTATE	Match?	NOTICE message
V3-01	UNIQUE	23505	23505	OK	`duplicate key value violates unique constraint "tac_logical_unit_canonical_address_key"`
V3-02	FK (adapted)	23503	23503	OK	`insert or update on table "tac_change_set" violates foreign key constraint "tac_change_set_publication_id_fkey"`
V3-03	CHECK	23514	23514	OK	`new row for relation "tac_publication" violates check constraint "tac_publication_risk_tier_check"`
V3-04	NOT NULL (via trigger BG-LU-05)	23502	23502	OK	`BG-LU-05: owner rỗng`
V3-05	Trigger BG-LU-01 (regex)	23514	23514	OK	`BG-LU-01: canonical_address WRONG-FORMAT không khớp regex D38-local`
V3-06	Trigger BG-LU-03 (parent doc_code)	23514	23514	OK	`BG-LU-03: parent doc_code D38-PARENT != child doc_code D38-CHILD`
V3-07	Trigger PM-CONSISTENCY (adapted)	23514	23514	OK	`INV-PM-CONSISTENCY: pm.logical_unit_id (954c...) != uv.logical_unit_id (97e5...)`
V3-08	Cleanup verify (LU/UV/PUB/PM remaining)	0/0/0/0	0/0/0/0	OK

Adaptations documented:

V3-02 retargeted from tac_logical_unit.section_type (where trigger BG-LU-04 fires before FK validation per PG semantics — BEFORE INSERT triggers run before constraint checks, raising 23514 not 23503) to tac_change_set.publication_id (no birth-gate trigger; FK enforced by PG directly).
V3-07 canonical_address changed D38-G6TEST-LU1/LU2 → D38-G6TEST-S1/S2 to satisfy BG-LU-01 regex ^D38-[A-Z0-9]+-((ROOT)|(S[0-9]+...))$ per package §6.2 (package's V3-07 sample data inconsistent with the regex it ships).

4.4 Stage 4 — V4 Production isolation (V4-01 → V4-07)

V	Check	Expected	Actual	Match
V4-01	PF-02 expanded re-run	total_violations=0	0	OK
V4-02	`public.fn_tac_*` whitelist	only `fn_tac_log_checker_issue` (count=1)	1 / `{fn_tac_log_checker_issue}`	OK
V4-03	`taxonomy_facets` unchanged	(cite KB E6)	E6 PASS in KB — no Directus API call this run	OK via override
V4-04	`dot_tools` unchanged	(cite KB E7)	E7 PASS in KB — no Directus API call this run	OK via override
V4-05	system_issues schema-adaptive	0 rows since RUN_START_TS mentioning p9_g6_dryrun	`recent_p9_rows_via_first_seen=0`, `recent_p9_rows_via_detected=0`, `any_p9_evidence_snapshot=0`	OK
V4-06	dot_action_log schema-adaptive	0 rows (HE-08) OR table N/A	N/A: `table_exists=0` (table not in public on this VPS) → HE-08 vacuously PASS	OK
V4-07	backup integrity post-run	re-verify	already verified at PF-07 v0.5	OK

V4-05 schema-adaptive findings: system_issues columns — {business_logic_hash, coalesce_key, code, description, detected_at, entity_code, entity_type, evidence_snapshot, first_seen_at, id, issue_class, issue_type, last_seen_at, occurrence_count, parent_issue_id, reopen_count, resolution, resolved_at, resolved_by, run_id, severity, source, source_system, status, sub_class, title, verification_contract_id, violation_hash} — no created_at or details. Adapted query: filter on first_seen_at/detected_at with evidence_snapshot::text LIKE '%p9_g6_dryrun%'. Result: 0 rows.

V4-06 schema-adaptive findings: dot_action_log table does NOT exist in public schema on this VPS. Per prompt §8.4.1 fallback: "IF NOT table_exists: report N/A, PASS by default (HE-08 vacuously holds)." HE-08 enforced by absence.

5. Rollback results (§9.1)

Step	Action	Expected	Actual	Match
1	Sanity check (14 tables before)	14	14	OK
2	`DROP SCHEMA IF EXISTS p9_g6_dryrun CASCADE`	NOTICE drop cascades to 20 objects	NOTICE: 14 tables + 6 functions cascaded (triggers cascade with tables)	OK
3a	schema_residue	0	0	OK
3b	table_residue	0	0	OK
3c	function_residue	0	0	OK
3d	trigger_residue	0	0	OK
3e	sequence_residue	0	0	OK
3f	type_residue	0	0	OK
4	cross-schema p9_g6_dryrun.* objects	0	0	OK
5	post-rollback PF-02 (production violations)	0	0	OK
6	whitelisted `fn_tac_log_checker_issue` still present	1	1	OK
7	spot-check tac_* tables anywhere	0	0	OK
8	spot-check fn_tac_* (non-whitelist) anywhere	0	0	OK

R-01 → R-08 ALL PASS. Rollback clean. Production state: identical to pre-execution.

6. Hard exclusion compliance audit

HE	Description	Compliance	Evidence
HE-01	KHÔNG `CREATE/ALTER/DROP public.tac_*`	OK	V4-01 = 0; all DDL schema-qualified to `p9_g6_dryrun.*`
HE-02	KHÔNG modify Directus roles	OK	No Directus API mutation this run
HE-03	KHÔNG modify Directus collections	OK	No Directus API mutation this run
HE-04	KHÔNG activate cron	OK	No cron operations
HE-05	KHÔNG `INSERT/UPDATE/DELETE taxonomy_labels`	OK	No labels mutation
HE-06	KHÔNG `INSERT/UPDATE/DELETE entity_labels`	OK	No labels mutation
HE-07	KHÔNG `INSERT system_issues`	OK	V4-05 phase 2 = 0 rows mentioning p9_g6_dryrun
HE-08	KHÔNG `INSERT dot_action_log`	OK vacuously	V4-06: table not in public (does not exist)
HE-09	KHÔNG cleanup `_dot_origin`	OK	No metadata cleanup
HE-10	KHÔNG behavior test ngoài V3 smoke	OK	V3 limited to 8 sub-tests (V3-01 → V3-08)
HE-11	KHÔNG `DROP/ALTER public.fn_tac_log_checker_issue`	OK	Function still present post-rollback
HE-12	KHÔNG modify `dot_tools/taxonomy_facets`	OK	Cite KB E6/E7 (no live mutation)
HE-13	KHÔNG modify GSM secrets	OK	Wrapper override: no GSM/token reopen
HE-14	KHÔNG hardcode `-U directus` (in bundle/seed)	OK	§7.3 grep test 3 PASS
HE-15	KHÔNG unqualified DDL	OK	§7.3 grep test 1 PASS
HE-16	KHÔNG bypass pre-flight	OK	All 7 wrapper checks + remaining prompt PFs sequential, fail-stop
HE-17	KHÔNG `CREATE EXTENSION`	OK	§7.3 grep test 2 PASS
HE-18	KHÔNG auto-DROP schema in pre-flight	OK	PF-01 STOP-on-exists honored (schema didn't exist; if it had, would have escalated)
HE-19	KHÔNG self-install missing tools/env	OK	PF-Pre.1 verified all tools present pre-execution

0 hard exclusion violations.

7. Errors / issues / blockers

7.1 Adaptations (documented, non-blocking)

§7.3 grep Test 1 false-positive on multi-line CREATE TRIGGER. Initial bundle had CREATE TRIGGER trg_tac_X\n BEFORE INSERT\n ON p9_g6_dryrun.table_X\n ... — grep regex matched the first line (CREATE TRIGGER trg_tac_*) but the schema-qualified ON p9_g6_dryrun.* was on a separate line. Refactored all 6 CREATE TRIGGER statements to single-line so the inverse grep grep -v 'p9_g6_dryrun\.' correctly excludes them. Bundle SHA-256 changed from e6e6975... to c23987f....
§7.3 grep Test 5 false-positive on schema COMMENT. Initial COMMENT contained verbatim phrase DROP SCHEMA p9_g6_dryrun CASCADE (rollback hint). Rewritten to Rolled back via cascade-drop in §9 to satisfy grep test (which doesn't distinguish comment text from DDL).
V3-02 retargeted (Section 4.3 above) — original test on tac_logical_unit.section_type would raise 23514 (BG-LU-04 trigger fires before FK), not the expected 23503. Adapted to tac_change_set.publication_id to test pure PG FK enforcement (no birth-gate trigger on tac_change_set).
V3-07 canonical_address (Section 4.3 above) — package's sample data D38-G6TEST-LU1/LU2 doesn't satisfy the BG-LU-01 regex it ships (^D38-[A-Z0-9]+-((ROOT)|(S[0-9]+...))$); changed to D38-G6TEST-S1/S2.

7.2 Blockers

None. All checks passed, all verifications passed, rollback clean.

7.3 Observed side effects (informational, not violations)

public.trigger_guard_alerts received 6 audit rows (one per CREATE TRIGGER fired) from this run. Format: (trigger_name='trg_tac_X on p9_g6_dryrun.table_X', table_name='unknown', expected_enabled=t, actual_enabled=t). This is the existing TRIGGER-GUARD audit mechanism (fn_evt_trigger_guard); not in hard exclusions list; expected behavior. Drop guard (fn_evt_trigger_guard_drop) did not write additional rows on cascade-drop (its handler logs explicit DROP TRIGGER only).

8. Conclusion

G6 PASS: YES
15/15 PASS criteria (per package §15.1):
1. 11 pre-flight checks (PF-Pre + PF-01→PF-10 with PF-07 v0.5 wrapper override) — PASS
2. Schema p9_g6_dryrun created — PASS
3. 14 tables compile match P8 §1.4 — PASS
4. FK/UNIQUE/CHECK constraints bind (17 FK / 5 UNIQUE / 115 CHECK) — PASS
5. ≥21 indexes (41) — PASS
6. 6 functions compile + SECURITY DEFINER + search_path locked — PASS
7. 6 triggers attached — PASS
8. Seed 61 rows + SHA-256 (PENDING_COMPUTE first run, hashes recorded) — PASS
9. Constraint smoke V3 (8 sub-tests) — SQLSTATE expected = actual — PASS
10. Production isolation V4-01→V4-07 PASS
11. Rollback DROP SCHEMA CASCADE → 0 residue — PASS
12. Action log uploaded KB (this file, includes DDL bundle hash + 8 seed hashes) — PASS
13. Hard exclusions HE-01→HE-19 not violated — PASS
14. GPT/User authorize execution gate (chain: GPT R23 + R24 + User GO) — PASS
15. (pending) User authorize G6 PASS → G8
Recommendation: Proceed to G8 (Directus roles gate). G6 dry-run validates DDL/functions/triggers fully ready for production migration; rollback proven clean.

9. Evidence files (local agent workspace on VPS)

/tmp/g6_run4_20260428_041121/
├── ddl/
│   ├── bundle.sha256                       # c23987f29911e92d43d9ab6cb5e4fe77d64547785d98588859dfcc6f02997cad
│   ├── bundle-output.txt                   # full psql output of bundle execution
│   └── g6_execution_bundle.sql             # 23,528 bytes / 566 lines
├── seed/
│   ├── all_seeds.sql                       # concatenated 8 seeds
│   ├── seed-output.txt                     # INSERT 0 N output
│   ├── seeds.sha256                        # 8 SHA-256 lines
│   └── seed-tac-*.sql                      # 8 canonical files
├── verify/
│   ├── v3_constraint_smoke.sql             # adapted V3 with V3-02/V3-07 fixes
│   └── v3_output.txt                       # all 8 V3 NOTICE messages
├── preflight/                              # (pre-flight outputs captured inline; raw stored in /tmp/g6_local/)
└── rollback/                               # (rollback output captured inline)

Local archive copies on driver host: /tmp/g6_local/{seed,ddl,verify,grep-tests-output.txt,v1_v2_output.txt,v4_output.txt,v4_phase2_output.txt,rollback_output.txt}.

10. 22-item self-check (prompt §11)

#	Item	Status	Evidence
1	Read 5 docs (incl errata)	PASS	§0.3 G1 + §0.2 quotes
2	5-GATE + Assembly Gate answered	PASS	§0.3
3	PF-Pre 5 checks PASS	PASS	§1
4	All PF-01→PF-10 PASS	PASS	§2
5	PF-01 schema not exists (no auto-DROP)	PASS	§2 W5/PF-01
6	DDL bundle generated + SHA-256 recorded	PASS	§0.1, §3.1
7	Grep tests 5/5 PASS	PASS	§3.2
8	Schema p9_g6_dryrun created	PASS	V1-01
9	14 tables compile	PASS	V1-02
10	FK ≥12 / UNIQUE ≥2 / CHECK ≥24	PASS	V1-03/04/05: 17/5/115
11	Indexes ≥21	PASS	V1-06: 41
12	6 fn + 6 tg, SECURITY DEFINER + search_path locked	PASS	V1-07/08/09/10
13	61 seed rows, hash recorded (PENDING_COMPUTE first run)	PASS	V2-09, §0.1
14	V3-01→V3-07 SQLSTATE expected = actual	PASS	§4.3
15	V3-08 cleanup 0 residue	PASS	§4.3
16	V4-01→V4-04 PASS	PASS	§4.4
17	V4-05 schema-adaptive PASS or N/A	PASS	§4.4
18	V4-06 schema-adaptive PASS or N/A	PASS	§4.4 (N/A — table absent)
19	Rollback DROP CASCADE → 0 residue	PASS	§5
20	HE-01→HE-19 not violated	PASS	§6
21	Action log uploaded KB	PASS	this file
22	No hardcoded credentials, no CREATE EXTENSION, all DDL schema-qualified	PASS	§3.2 grep tests

22/22 PASS.

11. STOP — agent stops here per prompt §13

After upload of this log, agent DỪNG. No further mutation. Awaiting Opus + GPT review then User authorize G6 PASS → G8.

P9 G6 Migration Dry-Run — Run 4 — Action Log | S184 | 2026-04-28 | Claude Code (Opus 4.7, xhigh) | PASS Bám: P9-G6-execution-prompt.md v0.2 OFFICIAL + Wrapper v0.6 (PF-07 v0.5) Authorize chain: GPT R23 PASS + GPT R24 PASS w/ patches + User GO