dot-iu-cutter v0.5 — First Controlled CUT · Post-CUT Governed Recording Obligation (leg-B)

doc 6 of 7 · 2026-05-20 · OBLIGATION (audit-debt) created by the UB-2 decoupling. DESIGN ONLY. NOT executed in this approval package. Records what MUST be recorded after the first leg-A CUT, and what package shape is needed.

1. Why this obligation exists (UB-2 decoupling, rephrased)

ratified UB-2 ruling (GPT 2026-05-19) :
  first controlled Constitution CUT writes ONLY leg-A under cutter_exec in one
  atomic transaction (doc 3). The governed leg-B (cut_change_set + DOT-991
  signature + decision_backlog history + manifest_envelope / unit_block) is
  recorded SEPARATELY by the ALREADY-PASSED v0.4 production governed path
  AFTER the first CUT — NOT in the same command, NOT by this branch's code.
why this is honest (not a corner-cut) :
  - the v0.4 governed path proved that exact rich-shape write in production
    on 2026-05-17 (the +15 rows ratified record).
  - the v0.5 branch has no production-shaped row-builder for these 7 leg-B
    tables (GAP-B1) — re-implementing it blind would be the exact forbidden
    fabrication mode.
  - decoupling minimizes blast radius of the first CUT (180 statements, 1
    txn, 2 tables, 1 column-scoped UPDATE) while preserving full governed
    audit through the v0.4 path executed after.
audit debt created :
  between the leg-A CUT COMMIT and the leg-B governed recording COMMIT, the
  60 new ICX-CONST IU+UV rows EXIST in public.* WITHOUT a matching
  cut_change_set row. This is the UB-2 acknowledged audit-debt window. It
  MUST be closed within a sovereign-defined time budget (recommended ≤ 24
  hours ; harder bound at sovereign discretion).

2. What MUST be recorded — the leg-B governed row-set for this CUT

target schema : cutter_governance (single DB ; single atomic txn ; principal
                cutter_exec / DOT-991 lane ; existing CD-1..CD-13 grants apply
                unchanged).

required leg-B row-set bound to manifest_digest = 9d908a62… :

  1 row    cutter_governance.cut_change_set
    NOT NULL columns to populate :
      change_set_id (uuid pk)
      idempotency_key (UNIQUE ; recommend: 'constitution-cut-1::9d908a62…')
      rollback_key (recommend: 'constitution-cut-1::rollback::9d908a62…')
      content_hash = '9d908a62fcf01bb88e05a1af4335b960710006ddcfd21c811ca63efb33dd324f'
      manifest_version, manifest_id (FK → manifest_envelope.id)
      review_decision_id (FK → review_decision.id — see row 7 below ; mandatory)
      executor_tool_revision, verifier_tool_revision
      state ('emitted' or v0.4-equivalent governed state)
      risk_class
      affected_unit_count = 60
      emitted_by = cutter_exec ; emitted_at = COMMIT timestamp of the leg-A CUT
      version (governed schema version)
      (+ any other NOT-NULL columns in the live 24-col schema at runtime)

  60 rows  cutter_governance.cut_change_set_affected_row
    one per IU inserted (id, change_set_id, affected_table='public.information_unit',
    affected_pk=<iu.id>, action='INSERT', etc.) — exact NOT-NULL set per live
    schema.

  1 row    cutter_governance.manifest_envelope
    NOT NULL : operation_kind ('cut'), status ('emitted'), source_doc_ref =
    'icxconst-008a06ace23a96ea6cd456146e805c97', created_by='cutter_exec/
    DOT-991/constitution-cut', created_at=now(), manifest_id (UNIQUE), digest
    = '9d908a62…', file_sha256 = '7d56f3ce…', file_bytes = 84157.

  60 rows  cutter_governance.manifest_unit_block
    one per candidate (block_role, source_span jsonb, render_order, etc.) —
    the exact NOT-NULL set per live schema ; binds each block to its IU id.

  1 row    cutter_governance.dot_pair_signature
    signature_kind='executor', signer_dot_id='DOT-991', signer_tool_revision,
    payload_hash, payload_envelope jsonb, signature_payload, signed_at,
    validation_state='valid', cross_reference_change_set_id = <the cut_change_set
    above's id>, cross_reference_verify_result_id = NULL  (binding mandate
    dot-iu-cutter-v0.4-dot-lane-overlap-prevention-gpt-mandate-2026-05-17 ;
    enforced in code by prod_iu_adapter.assert_lane_overlap_invariants).

  1 row    cutter_governance.decision_backlog_entry
    decision_kind='constitution-first-controlled-cut' (or v0.4-equivalent),
    state, owner, target_artifact_ref = the cut_change_set id, etc.

  1 row    cutter_governance.decision_backlog_history
    transition row recording the state change at emission (per v0.4 doctrine).

  1 row    cutter_governance.review_decision
    the upstream governed REVIEW DECISION that authorizes this CUT ; its id
    becomes cut_change_set.review_decision_id. NOT NULL on the live schema —
    must exist before the leg-B txn opens.

total leg-B rows : 1 + 60 + 1 + 60 + 1 + 1 + 1 + 1 = 126 rows ; 1 atomic txn.
not-this-CUT scope (leg-B txn writes NONE of these) : public.information_unit,
  public.unit_version, public.dot_config, source_document, source_document_
  version, Directus app, vector, NoSQL.

3. Package shape needed for the leg-B governed-recording step

shape       : ANOTHER 6–7 doc sovereign-gated command-review package, analogous
              to this one, scoped specifically to leg-B for this CUT digest.
folder      : knowledge/dev/laws/dieu44-trien-khai/v0.5-first-controlled-cut-
              legB-governed-recording-package/
authoring source for the row-builder : the v0.4 production trial's rich
              row-builder (which produced the 2026-05-17 +15-row leg-B record
              successfully). Recovery path: locate it in the v0.4 deployment
              tree / KB ; if recoverable, REUSE it as-is (no new fabrication).
              If not recoverable, open a SEPARATELY-gated authoring micro-cycle
              for a production-shaped row-builder bound to the live 24-col
              schema, with a scratch cutter_governance-mirror integration
              proof (UB-1 path — but only as a recovery option, NOT the
              default UB-2 path).
required content per doc :
  L-1 readiness re-verification : public.* delta = exactly +60/+60/anchor=60 ;
                                  cutter_governance state pre-attempt ; live
                                  schema of leg-B tables (post-CUT capture)
  L-2 row-builder evidence       : provenance of the v0.4 builder ; sha256 ;
                                  diff vs current live cutter_governance schema ;
                                  scratch-mirror integration proof
  L-3 leg-B command package      : exact command ; inputs ; expected 126 rows ;
                                  txn model ; STOP / fail-closed guards
  L-4 leg-B verification plan    : symmetric to doc 4 here, for leg-B tables
                                  (counts, idempotency, lane-overlap invariants,
                                  back-references to leg-A row ids)
  L-5 leg-B rollback / compensation : atomic abort + forward-comp ; never
                                  delete the leg-A rows ; relationship to
                                  cutter_governance ledger maintenance
  L-6 cross-binding proof        : EACH of the 60 leg-A IU rows is referenced
                                  in EXACTLY one cut_change_set_affected_row ;
                                  EVERY manifest_unit_block points to a live
                                  IU id ; lane-overlap invariants pass.
  L-7 leg-B final approval report
sovereign approvals at execution :
  - sovereign leg-B execution approval (separate KB doc id ; not the leg-A
    approval reused — distinct write, distinct audit)
  - the v0.4 governed-path operator approval (whoever ran the 2026-05-17 leg-B
    is the role precedent ; sovereign confirms or designates equivalent)
audit-debt budget : recommended ≤ 24 hours after the leg-A COMMIT. After that,
  sovereign issues a written explanation in KB ; the window is monitored
  through the open `cs_new_for_digest=0` invariant in doc 4 VW-11 (a daily
  audit query alert).

4. Cross-binding obligations (must hold after BOTH legs have committed)

INV-A  exactly 1 cut_change_set row with content_hash = 9d908a62… exists.
INV-B  cut_change_set.affected_unit_count = 60 AND there are exactly 60
       cut_change_set_affected_row rows referencing that change_set_id with
       action='INSERT' and affected_table='public.information_unit' AND each
       affected_pk corresponds to a live public.information_unit.id whose
       canonical_address LIKE 'ICX-CONST/%'.
INV-C  exactly 1 manifest_envelope row with digest=9d908a62… and file_sha256=
       7d56f3ce… and file_bytes=84157.
INV-D  exactly 60 manifest_unit_block rows referencing that manifest_envelope
       row ; each block_role consistent with the leg-A IU's level (NT/KT/DIEU).
INV-E  exactly 1 dot_pair_signature row with signer_dot_id='DOT-991' and
       cross_reference_change_set_id = the cut_change_set id AND
       cross_reference_verify_result_id IS NULL.
INV-F  1 decision_backlog_entry + 1 decision_backlog_history transition
       referencing the cut_change_set id.
INV-G  1 review_decision row referenced by cut_change_set.review_decision_id.
INV-H  re-running leg-B with the same idempotency_key ⇒ NO-OP (G-CUT-ONCE
       analogue ; UNIQUE on cut_change_set.idempotency_key enforces this).
INV-I  cutter_governance.verify_result remains UNTOUCHED by this leg-B step
       (DOT-992 VERIFY signature on verify_result_id is its own SEPARATE
       sovereign-gated step ; lane-overlap invariants forbid DOT-991 from
       cross-referencing verify_result_id).

5. Status

post_cut_governed_recording_obligation : SPECIFIED · OWED · NOT EXECUTED
package shape                           : separately-gated 6–7 doc package
audit-debt window                       : ≤ 24 h (recommended) post leg-A COMMIT
production mutation this phase          : NONE
self_advance                            : PROHIBITED

doc 6 of 7. No production mutation. Self-advance PROHIBITED.