dot-iu-cutter v0.5 — Cutwrite DB-Isolated Writer · Birth-Gate Dry-run Result

doc 3 of 5 · 2026-05-19 · ran in ephemeral /tmp scratch (now shredded); byte-reproducible by re-running the deterministic command below (no DB).

1. Procedure (net-zero)

1. regenerate manifest.json into /tmp via committed dryrun.extract_region→
   snapshot_gate→build_manifest over the pinned fixture (file sha 7d56f3ce… == pinned).
2. python3 -m cutter_agent.cutwrite --mode db-isolated-dryrun --no-production
   --fail-closed --exclude-dieu-44 --manifest $WD/manifest.json
   --snapshot-artifact ./constitution-normalized-17660443e0f23e99.md
   --expect-manifest-digest 9d908a62… --expect-manifest-file-sha 7d56f3ce…
   --expect-candidate-count 60 --expect-region-sha 17660443…
   --source-version-id icxconst-008a06… --docprefix ICX-CONST
   --scope enacted_only --out-dir $WD/out
   (all DB env unset; $WD = mktemp -d /tmp/icx-cutwrite.XXXXXX, chmod 700, OUTSIDE repo)
3. capture artifacts + shas; rm -rf $WD.

2. Result — PASS (exit 0)

status: PASS · mode: db-isolated-dryrun · production_touched: false
db_write: NONE (in-memory ScratchGovernedDB)
iu_inserted: 60 · uv_inserted: 60 · anchor_updates: 60
preexisting_icx_const: 0
idempotent_rerun_noop: true            # 2nd existence check sees all 60 (G-CUT-ONCE)
dieu_44_present: false
levels: { NGUYEN_TAC: 15, KIEN_TRUC_SECTION: 3, DIEU: 42 }   # == accepted MARK identity
all_law_unit: true
all_top_level_null_parent: true        # OD-W3: flat address ⇒ NULL parent, count 60
idempotency_keys_distinct: true        # 60 distinct OD-1 keys
writer_digest_sha256: d99a31d4a4be907c510ae15965e9f7bb3387e9e28676e9f32adf463828b1aa28
  (deterministic; identical in-test and in the /tmp run ⇒ cross-env determinism;
   content-addressed — excludes the random uuid row ids by design)

3. Birth-gate proof

L1 (BEFORE INSERT, all 60): PASS — every IU has non-empty canonical_address/unit_kind/
  lifecycle_status/owner_ref/conformance_status; unit_kind=law_unit ∈ vocab;
  identity_profile.title (from snapshot span) + owner_lookup_ref + primary_section_type_ref
  (principle/section/article ∈ vocab) + publication_type_ref=law (∈ vocab) +
  publication_authority_ref=incomex_council all present.
L2 (DEFERRED @ COMMIT, all 60): PASS — content_anchor_ref non-empty; version_anchor_ref
  not null; each anchors a unit_version WHERE id=anchor AND unit_id=IU.id;
  content_anchor_ref == str(version_anchor_ref).
UNIQUE(canonical_address): no collision (0 preexisting; 60 distinct verbatim addresses).
body fidelity (OD-W9): the run only PASSes because sha256(body span slice) ==
  candidate.span_sha256 held for ALL 60 (else build_rows ⇒ FailClosed exit 3).
transaction: single txn — 60 INSERT IU → 60 INSERT unit_version → 60 UPDATE anchor →
  commit (L2 ×60). All-or-nothing proven by TestRollbackAtomicity + L2-missing-anchor test.

4. Emitted artifacts (sha256; /tmp, shredded — reproducible)

birth_gate_result.json       ab67e6b931f2fcae5cce8a94848b6290e012e5b52f38375dafd51649bbf43b7c
cutwrite_dryrun_report.md    fe97289f8ecbd913ad16f3c50945e3a295ed2ac4b0af75c12b42deeb209422e5
iu_rowset.json               e8acd424fe8c080a2b666110b0ba6b5e0ccd103f119d8d956aa3e036b58dc60f
unit_version_rowset.json     e5949e0ea374fb7198adfbe490cc2cb3f70ef17510af5932a5ae519c53f926e2
writer_digest.md             64528e6a9425db57ee9d6b15ab649d83a16240e4e25a59a109f90ce3ffd4d438
note: iu_rowset/unit_version row `id`s are random uuid4 ⇒ those two file shas vary per
  run BY DESIGN; the production-truthful identity is writer_digest d99a31d4… (stable).

5. Cleanup / repo

scratch: rm -rf $WD ⇒ scratch_removed_ok. No file outside scratch. No DB touched.
repo: HEAD f0120ac (the W-3 commit), working tree clean, main 4367c83 UNCHANGED.

doc 3 of 5. Net-zero scratch run. No production mutation. Self-advance PROHIBITED.