DOT-119 Repair P2 — Script Rewrite + Smoke Tests Report

Date: 2026-05-05 Agent: Opus 4.7 (1M ctx) Controlling: 18b-P2 prompt rev 6 + 18a rev4 + 18b rev3 + P1 PASS + GPT P2 directive Status: PASS — all 18 smoke tests green, v2 active, fn_hash invariant preserved, no rollback.

---

1. Bước 0 — Controlling docs read

Read on KB:

• knowledge/dev/laws/dieu44-trien-khai/prompts/18b-p2-dot119-script-rewrite-prompt.md (rev 6)
• knowledge/dev/laws/dieu44-trien-khai/design/dot119-v2-script-content.sh (rev 5, 14270 bytes)
• knowledge/dev/laws/dieu44-trien-khai/reports/dot119-repair-p1-metadata-ddl-seed-report.md (P1 PASS)
• knowledge/dev/laws/dieu44-trien-khai/reviews/gpt-review-dot119-p1-report-and-p2-directive-2026-05-05.md (GPT P2 directive)
• 18a rev4 + 18b rev3 (referenced via P1 report)

---

2. Bước 1 — Preflight (run-local on VPS)

Check	Value	Gate
3 metadata cols (birth_code_strategy/birth_code_column/birth_identity_source)	present, NOT NULL/NULL/NOT NULL with defaults 'unclassified'	OK
CHECK constraints	collection_registry_birth_code_strategy_check, collection_registry_birth_identity_source_check	OK (2)
fn_hash_baseline	1f729b3571a74963089bb3ef388217f3	OK (matches P1)
trigger_count_baseline	30	OK (matches P1)
birth_count_baseline	75613	run-local capture
birth_code_strategy IS NULL	0	OK
birth_identity_source IS NULL	0	OK

Smoke samples (metadata-selected, no hardcode)

Sample	Value
SAMPLE_CODE (column, code='code')	agents
SAMPLE_NONCODE (column, code<>'code')	law_catalog (column=law_code)
SAMPLE_UNCLASSIFIED	admin_fallback_log
SAMPLE_DISABLED	birth_registry

---

3. Bước 2 — Backup v1

Field	Value
v1 path	/opt/incomex/dot/bin/dot-birth-trigger-setup
v1 size	8948 bytes / 275 lines
v1 md5	a0b926d3fd373b8995aea2f4e8136e01
BACKUP_PATH	/opt/incomex/backups/dot-birth-trigger-setup.v1.bak.20260505080351
backup md5	a0b926d3fd373b8995aea2f4e8136e01 (identical)

---

4. Bước 3 — Install v2 (atomic)

Step	Result
Local write /tmp/dot119-v2.sh	365 lines, sha256=931ef2dfc6d740e31470d1f195292b500b69f60da193fe2d00787e302c02aa2f
bash -n (local)	OK
no-clobber grep (local)	0
scp → VPS /tmp/dot-birth-trigger-setup.v2.staging	OK
Temp md5 (VPS)	5883bce405b86ab436e885cf16fd22de
Temp sha256 (VPS)	931ef2dfc6d740e31470d1f195292b500b69f60da193fe2d00787e302c02aa2f (matches local)
bash -n (VPS)	OK
grep -cF 'CREATE OR REPLACE FUNCTION fn_birth_registry_auto'	0 ✓
chmod 755 + atomic mv	OK
Installed md5	5883bce405b86ab436e885cf16fd22de
Installed lines	365
Installed perms	-rwxr-xr-x root root 14417 bytes

---

5. Bước 4 — 18 Smoke tests

#	Test	Expected	Actual	Result
1	no args	exit 1	exit 1 (usage printed)	PASS
2	--help	exit 0	exit 0 (usage printed)	PASS
3	--collection=dot_tools --dry-run --execute (multi-mode)	exit 1	exit 1 (Exactly one of...)	PASS
4	--collection=agents --dry-run --json	exit 0	exit 0; JSON shows strategy=column, code_column=code, args='code', fn_hash=1f729b35…	PASS
5	--collection=law_catalog --dry-run --json	exit 0	exit 0; strategy=column, code_column=law_code, args='law_code'	PASS
6	--collection=information_unit --dry-run --json	exit 0 + synthetic_capability:"pass"	exit 0; args='__birth_synthetic_id__'; "synthetic_capability":"pass" ✓	PASS
7	--collection=admin_fallback_log --dry-run (unclassified)	exit 10	exit 10 (STOP: 'admin_fallback_log' unclassified.)	PASS
8	--collection=birth_registry --dry-run (disabled)	exit 0	exit 0 (SKIP: strategy=disabled)	PASS
9	--collection=unit_version --dry-run (subordinate)	exit 0	exit 0 (SKIP: strategy=subordinate)	PASS
10	--collection=agents --verify --json	exit 0	exit 0; status=verified, function=fn_birth_registry_auto, fn_hash=1f729b35…	PASS
11	--collection=birth_registry --verify --json (disabled)	exit 0	exit 0; status=verified_no_trigger	PASS
12	--collection=information_unit --verify --json	exit 14	exit 14; status=absent (IU trigger not yet installed; 18c only)	PASS
13	grep -cF 'CREATE OR REPLACE FUNCTION fn_birth_registry_auto' <installed>	0	0	PASS
14	fn_hash audit (live)	= 1f729b3571a74963089bb3ef388217f3	1f729b3571a74963089bb3ef388217f3	PASS
15	trigger count	= 30	30	PASS
16	birth_registry count	run-local capture	75613 (= baseline; no drift this window)	OK
17	--collection=dot_tools --drop (no DOT119_ALLOW_DROP)	exit 30	exit 30 (--drop needs DOT119_ALLOW_DROP=1 + --confirm-drop)	PASS
18	grep -c 'KNOWN_V2_FN_HASH' <installed>	0	0	PASS

SMOKE_FAILED = 0 → ALL 18 PASS.

synthetic_capability output (T6)

{"status":"dry-run","exit_code":0,"collection":"information_unit","strategy":"synthetic_id","code_column":"","trigger_name":"trg_birth_information_unit","function":"fn_birth_registry_auto","args":"'__birth_synthetic_id__'","trigger_exists":false,"proposed_sql":"CREATE TRIGGER trg_birth_information_unit AFTER INSERT ON public.information_unit FOR EACH ROW EXECUTE FUNCTION fn_birth_registry_auto('__birth_synthetic_id__');","fn_hash":"1f729b3571a74963089bb3ef388217f3","synthetic_capability":"pass"}

fn hash audit trail

Phase	fn_birth_registry_auto md5
P1 baseline (preflight)	1f729b3571a74963089bb3ef388217f3
P2 preflight	1f729b3571a74963089bb3ef388217f3
Post-install (T14)	1f729b3571a74963089bb3ef388217f3
Drift	0 — invariant preserved

trigger count trail

Phase	trg_birth_% count
P1 baseline	30
P2 preflight	30
Post-install (T15)	30

birth_registry count trail

Phase	count
P1 final	75472
P2 preflight (baseline this run)	75613
Post-smoke (T16)	75613

(Drift between P1 and P2 = +141 over background hours; within P2 window = 0. Anti-hardcode model: capture at preflight, compare to run-local final only.)

---

6. Bước 4★ — Rev 6 rollback decision

• SMOKE_FAILED = 0
• rollback_happened: no
• final_installed_script: v2 active
• final_installed_md5: 5883bce405b86ab436e885cf16fd22de
• v1 backup retained at /opt/incomex/backups/dot-birth-trigger-setup.v1.bak.20260505080351 for reference / future rollback if needed.

---

7. No-hardcode confirmation

DOT-119 v2 source contains:

• 0 occurrences of CREATE OR REPLACE FUNCTION fn_birth_registry_auto (T13)
• 0 occurrences of KNOWN_V2_FN_HASH (T18)
• 0 hardcoded collection name lists (information_unit, unit_version, law_catalog, workflows, code, process_code, law_code — all derived from collection_registry rows at runtime)
• All strategy/column/args derived from metadata read of collection_registry.birth_code_strategy/birth_code_column/birth_identity_source.
• Self-check at startup: split-string no-clobber sentinel exits 12 if violated.

Smoke samples (T4/T5/T6/T7/T8) used metadata-selected collections via SQL ORDER BY collection_name LIMIT 1, no hardcoding in the test harness.

---

8. Out of scope (explicitly NOT performed)

Per 18b-P2 rev 6 hard boundary (Bước 6):

• ✗ fn_birth_registry_auto edit
• ✗ IU trigger install (18c only)
• ✗ IU rows
• ✗ Pack 2B
• ✗ DDL changes (no schema/seed changes in this phase)

---

9. Tech-debt / notes

• T16 birth count uses run-local baseline only; per anti-hardcode directive, no stale numeric check is gated.
• v2 script size 14417 bytes (vs v1 8948 bytes) — increase comes from explicit metadata read, strategy gate logic, JSON emit, and self-check.
• v1 backup file is owned root:root (cp ran via root SSH); original v1 was incomex:incomex. If a future rollback restores from this backup, ownership will need to be reset to incomex:incomex to match parent dir convention.
• The previous P1 report mentions birth_registry count 75472 vs P2 preflight 75613 — that delta is normal background activity over the gap window; not material to v2 behavior.

---

10. Verdict

P2 PASS. All 18 smoke tests green. v2 metadata-driven script live at /opt/incomex/dot/bin/dot-birth-trigger-setup (md5 5883bce405b86ab436e885cf16fd22de). Function hash invariant preserved (1f729b3571a74963089bb3ef388217f3). Trigger count preserved (30). No rollback. v1 backup retained.

Ready for next phase per 18b umbrella (P3 / 18c IU trigger).

---

P2 report | 2026-05-05 | Opus 4.7 (1M ctx) | HARD STOP after this upload.