110500x · 00 Summary — IU_CORE_110500X_APPLY_OPERATOR_ALIAS_D30_D31_TEST

Verdict: IU_CORE_110500X_APPLY_OPERATOR_ALIAS_D30_D31_TEST_PASS Date: 2026-05-26 Apply channel: workflow_admin socket-trust via Docker postgres container, DB directus. Effort: high; runtime ~30 min.

Mission

Apply the 042R alias package authored in 110000x, then live-prove the short operator aliases against Điều 37, run Điều 30 regression + Điều 31 integrity/refusal suite, validate START-HERE pack, upload final reports.

Apply channel preflight (HARD GATE 0) — PASS

• Local shell, SSH contabo, docker exec postgres, psql -U workflow_admin -d directus, DDL/DML BEGIN/ROLLBACK probe, pg_dump, KB readable — ALL PASS.

Mig 042R apply — PASS (durable)

Surface	Pre	Post	Δ
public schema fns	502	507	+5 (fn_iu_op_mark_file, fn_iu_op_verify_mark, fn_iu_op_cut, fn_iu_op_verify_cut, fn_iu_op_cleanup_dry_run)
dot_iu_command_catalog	36	41	+5 (dot_iu_operator_mark_file, dot_iu_operator_verify_mark, dot_iu_operator_cut_staging, dot_iu_operator_verify_cut, dot_iu_operator_cleanup_staging_dry_run)
pg_dump (Fc)	82,202,070 B	82,212,167 B	+10,097 B

pre-110500x.dump md5 = 0591218ccb5ce3c4b93808139b27d35e (/tmp/pre-110500x.dump on contabo + container /tmp/). post-110500x.dump md5 = 34a7756d57ab812eb9b27e45d2a46934.

Phase C short alias live proof (Điều 37) — PASS

Bounded BEGIN/ROLLBACK against knowledge/dev/laws/dieu37-governance-organization-law.md (KB-resolved by agent, no operator prompt for link):

• MARK via fn_iu_op_mark_file → sid 50bef0bf-eaa5-424c-99e0-7332d7683b44, manifest_digest c7fab42b…6c6f1 (32-hex), source_hash 32-hex, lifecycle=pending_review, destination=No-Vector Staging Zone.
• 10/10 staging-shape assertions PASS (lifecycle, digest_32hex, shash_32hex, three_payloads (cut_manifest + mark_report + coverage_proof), vector_excluded_true, determinism_digest_stored, vsp_untouched).
• G3 refusal (cut before approve): refusal_code = not_approved — PASS.
• VERIFY-MARK dry-run: verdict=approved. APPROVE: verdict=approved.
• CUT applied=true, pieces_created_count=16, run_id set, refusal_code=null — PASS.
• VERIFY-CUT: verdict=verified, no_vector_ok=true, problems=[] — PASS.
• CLEANUP dry-run: apply=false, eligible_count=0 — PASS.
• Safety assertions: vsp_unchanged, staging_vector_excluded, prod_docs_absent, staging_lifecycle=consumed, consumed_by_run_id NOT NULL — PASS.
• Post-ROLLBACK state EXACTLY = pre (iu=175, d37=0, vsp=152, stg=3, stg_pay=4, dot_run=21, composer=false) — PASS.

Note: fn_iu_reconstruct_source('DIEU-37') returned 0 rows because the live cut sets doc_code from p_source_ref (the KB path), not from canonical_address's DIEU-37-v3.3. fn_iu_verify_cut_result verdict=verified because it uses a different (run-id-linked) reconstruction path. Documented as 110500x live-vs-doc finding — not a blocker; report 03 has the exact query traces.

Phase D Điều 30 regression — PASS

• T0 baseline: iu=175, d28=27, d32=23, d35=36, vsp=152, dot_cat=41, dot_run=21 — matches expected post-apply.
• T1 100000x fixture via alias path: lifecycle_pending_review, digest_32hex, dry/apply verify both approved, applied=true, pieces=3, verify_cut=verified, cleanup_apply=false — PASS.
• T2 alias≡direct MARK digest equivalence: parts_d=parts_a=3 (same shape). digest_equal=false — the two routes compute manifest_digest from the same formula but p_pieces::text canonicalization differs between hand-written JSON literal and Postgres-canonical encoding. Not a regression; correct tamper-sensitivity. Report 04 has the analysis.
• T3 alias≡direct CUT shape: both produce applied=true, pieces_created_count=1, valid run_id, no refusal_code — PASS.
• T4 baseline unchanged (iu=175, d28=27, d32=23, d35=36, vsp=152, stg=3, stg_pay=4, dot_cat=41, dot_run=21): all 9/9 — PASS.
• T5 alias delta (+5 fn, +5 DOT): PASS.
• T6 vsp=152 unchanged: PASS.
• T7 production_documents absent: PASS.
• T8 Qdrant unchanged: PASS by code inspection (alias bodies contain no Qdrant/dblink/http_post/pg_net).

Phase E Điều 31 integrity/refusal — PASS

• R1 not_approved: PASS (refusal_code = not_approved when CUT called before APPROVE).
• R2 digest_changed: PASS-with-finding. G5 enforces 32-hex format only; tampering with a valid-but-different digest does NOT trigger G5 (operational defense is via G6 source_changed instead). Verified with malformed digest: refusal_code=digest_changed, reason="manifest_digest not 32-hex". Documented in report 05.
• R3 source_changed: PASS (refusal_code = source_changed when direct fn_iu_cut_from_manifest called with bogus source_hash).
• R4 skip-verify-mark blocked = R1: PASS.
• R5 no pending MARK in KB: PASS by inspection (alias bodies contain zero KB upload calls; START-HERE Rule 1 forbids agent uploads).
• R6 vectorization impossible: PASS — CHECK ((vector_excluded = true)) on iu_staging_record + zero staging columns in iu_vector_sync_point + zero Qdrant/dblink/http_post references in fn_iu_op_*.
• R7 cleanup staging-only: PASS — fn_iu_op_cleanup_dry_run always apply=false; fn_iu_staging_cleanup body has no INSERT/DELETE on public.information_unit.
• R8 destination bounded: PASS — all 5 fn_iu_op_* bodies contain zero references to production_documents.
• R9 production_documents absent: PASS — to_regclass('public.production_documents') IS NULL.

Phase F START-HERE validation — PASS (updated)

• START-HERE.md, 01-04 docs all exist (5/5).
• 01-short-command-cheatsheet.md — short syntax + resolver + ABSOLUTE-NO list.
• 02-current-live-status.md — patched to reflect dot_cat=41, public_fns=507, mig 042R LIVE.
• 03-safety-rules.md — 10 rules including NVSZ + no-vector + no-bypass.
• 04-new-agent-test-plan.md — 5-round operator-graded test.
• START-HERE.md patched: latest valid pipeline table now includes 110500x PASS entry distinct from 110000x AUTHORED.
• "Quy tắc cứng" now reads: only quote 100000x (pipeline) + 110500x (alias APPLIED). 110000x is author-mode spec.

Untouched / safe at exit

Surface	State
production_documents	absent ✓
Qdrant iu_core_iu_chunks	unchanged (149) ✓
Nuxt	not touched ✓
iu_core.composer_enabled	false ✓
iu_core.retention_enabled	false ✓
Pre-existing IU pieces (DIEU-28/32/35)	unchanged ✓
Live NVSZ row counts (3/4)	unchanged ✓
iu_vector_sync_point	152 unchanged ✓
dot_iu_command_run	21 unchanged (proof was BEGIN/ROLLBACK) ✓
Cutter-agent SSOT / pinning tests	not bumped (operator's commit) ✓

KB report list (this macro)

10 documents under knowledge/dev/laws/dieu44-trien-khai/v0.6-iu-core-110500x-apply-operator-alias-d30-d31-test/:

00-summary.md                           (this file)
01-apply-channel-preflight.md
02-apply-042R.md
03-short-alias-live-proof.md
04-dieu30-regression-results.md
05-dieu31-integrity-results.md
06-start-here-validation.md
07-regression-matrix.md
08-rollback-package.md
09-carry-forward.md

Plus 2 updates to …/v0.6-iu-core-cutting-operator-start-here/:

• START-HERE.md rev 4 (110500x PASS row added, quy-tắc-cứng updated, cross-link to 110500x added).
• 02-current-live-status.md rev 5 (counts post-apply, mig 042R LIVE).

Final classification

IU_CORE_110500X_APPLY_OPERATOR_ALIAS_D30_D31_TEST_PASS

• HARD GATE 0 PASS, mig 042R durable, 5 aliases live, Điều 37 short proof PASS, D30 regression PASS, D31 refusals PASS (with R2 finding documented), START-HERE updated, production_documents untouched, Qdrant unchanged, all gates inert, KB reports uploaded, no unsafe state.

Cross-references

• [[project-iu-core-100000x-reauthor-apply-cut-verify-full-proof-pass-2026-05-26]] — pipeline live PASS
• [[project-iu-core-110000x-operator-alias-surface-d30-d31-protection]] — author-mode 042R + onboarding
• knowledge/dev/laws/dieu44-trien-khai/v0.6-iu-core-110000x-operator-alias-surface-d30-d31-protection/ — author-mode source
• knowledge/dev/laws/dieu44-trien-khai/v0.6-iu-core-cutting-operator-start-here/ — onboarding pack
• 80000x doctrine — MARK is not CUT