Phase 3 — MARK/CUT Queue Pilot (Điều 37) — WRITE-CHANNEL PASS

Status: DIEU45_PHASE_3_MARK_CUT_QUEUE_PILOT_DIEU37_WRITE_CHANNEL_PASS Date: 2026-05-26 Channel: SSH → contabo → docker exec postgres → psql -U workflow_admin -d directus (write-capable) Rerun rationale: previous attempt PARTIAL_WITH_EXACT_GAP — MCP query_pg bound context_pack_readonly and could not write. This rerun used the proven write channel and ran the pilot end-to-end.

1. Headline results

Identifier	Value
pilot_run_id	bf3e6f4d-12e1-40b6-9345-3880ada69c22
staging_record_id	258c715c-6f49-4e12-b62a-a64a6907f435
cut_run_id	a64340fe-96ea-428a-a860-32e8b471b496
Jobs enqueued	6 (all succeeded, 0 attempts retries)
DIEU-37 IUs created	17
Verify-cut verdict	verified (axis_a_ok=true, axis_b_ok=true, axis_c_ok=true, no_vector_ok=true, pieces_count=17)
DLQ rows	0
pg_dump baseline → post	83,207,353 → 83,224,464 B (+17,111 B)
event_outbox delta	0 (count 134,803 unchanged; rows_during_pilot=0)
iu_vector_sync_point	152 unchanged
production_documents	absent ✓
pg_cron	absent ✓
iu_route_worker_cursor.iu_outbound_default.last_run_at	frozen 2026-05-22 11:31:41+00 ✓
Gates at exit	queue.job_substrate.enabled=false, queue.worker.enabled=false, queue.notify.enabled=false, queue.lease.reaper_enabled=false, queue.dlq.replay_enabled=false, iu_core.composer_enabled=false

2. End-to-end sequence (all via job_queue)

#	job_kind	Outcome	Notes
1	cut.copy_to_staging	succeeded	input readiness: source 23,387 B + 17 pieces present
2	cut.mark	succeeded	fn_iu_op_mark_file → staging_record_id 258c715c
3	cut.verify_mark	succeeded	fn_iu_op_verify_mark(approve=true) → verdict=approved
4	cut.cut	succeeded	fn_iu_op_cut(apply=true, open_composer=true) → cut_run_id a64340fe
5	cut.verify_cut	succeeded	fn_iu_op_verify_cut(run_id) → verdict=verified (all axes ok, pieces_count=17)
6	cut.cleanup_checkpoint	succeeded	fn_iu_op_cleanup_dry_run(older_than_days=15) → eligible_count=0

3. Mid-flight incident

The first cut.cut attempt failed with:

section_type: Not in vocab. Available: appendix, article, changelog, checklist, definition, governance_process, heading, instruction_block, paragraph, principle, process, section, technical_spec

Cause: fn_iu_create (internal target of the cut) carries its own 13-item vocab — strictly narrower than tac_section_type_vocab (17 codes). My manifest used 3 codes that exist in the live vocab but not in fn_iu_create's internal list: matrix, reference_mapping, open_decision_list.

Recovery, in-place on the SAME staging_record_id:

• Patched the 3 offending entries in iu_core.iu_staging_payload.payload_json->'pieces' (the cut_manifest row), not in iu_staging_record.metadata.pieces:
  • pieces[10].section_type (p11): matrix → technical_spec
  • pieces[12].section_type (p13): reference_mapping → section
  • pieces[14].section_type (p15): open_decision_list → section
• Re-called fn_iu_op_cut against the same staging → success.
• cut.cut job was acked from the same lease (lease still held by pilot owner; no retry counter advanced).

This produced two operating lessons (see §6).

4. What durable state was changed

• 1 new row in iu_core.iu_staging_record (258c715c…), lifecycle_status='consumed', consumed_by_run_id=a64340fe…, vector_excluded=true.
• 3 new rows in iu_core.iu_staging_payload (cut_manifest / mark_report / coverage_proof).
• 17 new rows in information_unit with doc_code='knowledge/dev/laws/dieu37-governance-organization-law.md', canonical_address LIKE 'DIEU-37-v3.3#…', sort_order 1..17, valid section_type, child rows linked via parent_or_container_ref to the title piece.
• 6 new rows in job_queue (all succeeded).
• 1 new row in queue_heartbeat (dieu45_phase3_pilot, external_worker, last_tick_status='ok', ticks_total=2).
• 4 dot_config rows touched during the pilot, all returned to safe values at exit:
  • queue.job_substrate.enabled false → true → false
  • iu_core.composer_enabled false → true → false

5. D30 / D31 — protections honored

• D30 (regression): event_outbox unchanged, iu_vector_sync_point unchanged, production_documents absent, pg_cron absent, 5 alias signatures unchanged, no broad worker, legacy iu_route_worker_cursor still frozen. See 06-d30-regression-results.md.

• D31 (integrity):

  • Payload denylist refusal: confirmed (queue gate also refused — strictest wins).
  • Gate-off refusal: confirmed (all 4 enqueue refusals returned {"refused":true,"reason":"queue.job_substrate.enabled=false"}).
  • Cut on UNapproved manifest: refused with refusal_code="not_approved" (BEGIN/ROLLBACK proof).
  • DLQ replay disabled: refused dead_letter_not_found and gate queue.dlq.replay_enabled=false.
  • Stale executor surfaced (not silently healthy): fn_queue_stale_check() returned 1 stale (iu_outbound_default, age 359,352 s, last_tick_status='warn').
  • Lease owner mismatch: refused.

  See 07-d31-integrity-results.md.

6. New lessons (will be saved into memory)

1. fn_iu_create has a hardcoded 13-item section_type vocab narrower than tac_section_type_vocab (17 codes). Excluded by fn_iu_create: matrix, reference_mapping, open_decision_list, invariant_list, rationale. Authoring rule for manifests: stick to the 13-item set OR widen the function's internal list (future work).
2. Pieces in MARK staging live in iu_core.iu_staging_payload.payload_json->'pieces' (the cut_manifest row), NOT in iu_core.iu_staging_record.metadata.pieces. CUT reads the payload row; the metadata copy is informational. In-place repair must patch the payload row.

7. Forbiddens — all honored

• No broad worker start.
• No pg_cron install.
• No CHECK widening (job_queue.state, iu_piece_membership.piece_role, etc.).
• No event_outbox schema change.
• No Qdrant write (iu_vector_sync_point unchanged, vector_excluded=true on staging).
• No production_documents creation.
• No START-HERE.md change.
• No law text change.
• No MOT / customer / email runtime activation.

8. Cross-links

• Previous PARTIAL block: [[project-dieu45-phase-3-hard-gate-0-block-2026-05-26]]
• Phase 2 (governance + heartbeat live): [[project-dieu45-phase2-heartbeat-activation-lease-governance-pass-2026-05-26]]
• Phase 1 (substrate live): [[project-dieu45-phase1-minimal-job-substrate-live-apply-pass-2026-05-26]]
• Parent enacted law: [[project-dieu45-v1-0-enacted-2026-05-26]]
• Source operator alias pack: [[project-iu-core-110500x-apply-operator-alias-d30-d31-test-pass-2026-05-26]]

9. Next-phase carry-forward

See 09-carry-forward.md. Key items deferred for the next pack:

• Widen fn_iu_create internal vocab to mirror tac_section_type_vocab (or document the design intent that the function's vocab is the source of truth).
• Wire a real heartbeat caller for iu_outbound_default (still surfacing as stale, age > 4 days, in v_queue_health).
• Migrate the legacy 06a2fc30 pending_review staging (Codex's earlier attempt) — either complete or reject.