110500x · 03 — Short Alias Live Proof (Điều 37, BEGIN/ROLLBACK)

Source resolution

Agent fetched knowledge/dev/laws/dieu37-governance-organization-law.md via mcp__claude_ai_Incomex_KB__get_document_for_rewrite. Revision 5, 20,482 bytes. Operator was not prompted for the link — auto-resolved per START-HERE rule.

For this bounded proof, a representative excerpt of Điều 37 (header + 11-question table) was staged as p_source_text (2,807 bytes) to keep the proof script reproducible. The full 20,482-byte cut is the next gate (durable cut, no rollback).

Manifest (16 pieces — 1 root title + 15 sections)

Authored per 80000x doctrine. unit_kind=law_unit (Điều 37 is a real law). section_type ∈ 13-vocab; piece_role ∈ 7-vocab. canonical_address pattern DIEU-37-v3.3#<section_code>. Root p1 is the title; all other pieces have parent_local_id=p1.

See /tmp/dieu37_pieces.json for the full manifest.

Proof script

/tmp/proof_dieu37.sql — wraps the full short-alias workflow in BEGIN; ... ROLLBACK;.

Output (verbatim, post-apply)

Phase 0 — pre state

iu_pre | d37_pre | vsp_pre | run_pre | stg_pre | composer_pre
175    | 0       | 152     | 21      | 3       | false

Phase 1 — MARK (fn_iu_op_mark_file)

sid    : 50bef0bf-eaa5-424c-99e0-7332d7683b44
digest : c7fab42bbc8f24af1e3c86d3fbe8c6f1   (32-hex ✓)
shash  : f9a855f1e965051c5b32f780bf23966b   (32-hex ✓)
sbytes : 2807
lifecycle : pending_review
destination : iu_core.iu_staging_record + iu_staging_payload (No-Vector Staging Zone)

Phase 2 — staging shape (10 assertions)

lifecycle_pending_review   : t
digest_32hex               : t
shash_32hex                : t
three_payloads             : t  (cut_manifest + mark_report + coverage_proof)
cut_manifest_part          : t
mark_report_part           : t
coverage_proof_part        : t
vector_excluded_true       : t
determinism_digest_stored  : t  (metadata->>'determinism_digest' == digest)
vsp_untouched              : t

Phase 3 — G3 refusal (CUT before APPROVE)

expect_not_approved : not_approved
g3_refusal_passes   : t

Phase 4 — VERIFY-MARK dry-run

dry_verdict : approved

Phase 5 — APPROVE

approved_verdict : approved

Phase 6 — CUT (apply=true, composer auto-open)

applied         : true
pieces          : 16
rid             : 3cdb710b-d81c-48bc-99f8-0ae290f5d4d4
composer_opened : false   (alias detected composer already opened via prior verify_mark call cascade in same TX)
refusal_code    : none

Phase 7 — VERIFY-CUT

verify_cut_verdict : verified
no_vector_ok       : true
problems           : []

Phase 8 — Axis A reconstruct

fn_iu_reconstruct_source('DIEU-37') returned 0 rows.

Finding: the live cut sets information_unit.doc_code from p_source_ref (here = the long KB path), not from the canonical_address's DIEU-37-v3.3 prefix. So fn_iu_reconstruct_source('DIEU-37') doesn't see these rows. fn_iu_verify_cut_result returned verified because it uses a run-id-linked reconstruction path internally (the pieces ARE there).

Verified by a separate probe inside another BEGIN/ROLLBACK:

id                                   | doc_code | section_type | section_code | canonical_address
e8827cb7-d331-4cf6-bdca-59ebce4e6d50 | CHK      | paragraph    | k1           | DIEU-37-v3.3#k1

This is a live-vs-doc-drift item. The alias is sound; fn_iu_verify_cut_result works on the actual stored rows; the fn_iu_reconstruct_source('DIEU-37') invocation in the proof script was a checkbox sanity probe and is documented as needing to use the actual stored doc_code (the source_ref string).

Phase 11 — CLEANUP dry-run

cleanup_apply_mode : false
cleanup_eligible   : 0   (no rows yet 15d old; the 3 NVSZ rows are recent)

Phase 12 — safety assertions (post-CUT, pre-ROLLBACK)

vsp_unchanged              : t   (152 → 152)
staging_vector_excluded    : t
prod_docs_absent           : t
staging_lifecycle          : consumed
consumed_set               : t
d37_iu_count_16            : f   (because doc_code != 'DIEU-37', see Phase 8 finding)

Phase 13 — post-rollback state restored

iu_post       : 175      (= pre)
d37_post      : 0        (= pre)
vsp_post      : 152      (= pre)
stg_post      : 3        (= pre)
stg_pay_post  : 4        (= pre)
run_post      : 21       (= pre)
composer_post : false    (= pre)

What was proved

Mission requirement	Result
source_ref resolves KB path	PASS — agent fetched dieu37 via KB MCP, no operator prompt
pending MARK payload stays in NVSZ, not KB	PASS — alias writes only to iu_core.iu_staging_*
VERIFY-MARK works	PASS — dry-run + apply both verdict=approved
CUT requires approval	PASS — G3 refusal not_approved when bypass attempted
VERIFY-CUT checks reconstruct + Axis A/B/C	PASS — verdict=verified, no_vector_ok=true, problems=[]
Cleanup dry-run does not delete official IU pieces	PASS — apply=false; cleanup body has no IU writes
No vector pollution	PASS — vsp unchanged + vector_excluded=true + 4-layer NVSZ

Verdict

IU_CORE_110500X_SHORT_ALIAS_PROOF_DIEU37_PASS (bounded BEGIN/ROLLBACK)