06 — DOT / No-hardcode / Five-layer

No-hardcode — PASS

• 014_three_axis_metadata.sql — 0 uuid literal, 0 secret/api-key/IP. The tag_kind set and enrichment_source set are domain vocabulary (classified, CHECK-constrained). The 'doc:'/'kind:'/'sectype:' prefixes are namespacing conventions.
• fn_iu_metadata_refresh registers vocabulary by SELECT DISTINCT from live information_unit — discovered, never baked.
• runtime/230 / runtime/240 — bake no uuid, no doc code; the IU sets are discovered by query (test_discovery_driven_*).
• text_as_code.py — EXPORT_ROOT/UNFILED_BUCKET are layout constants; no DSN, host or secret.
• Repo-wide scan of the new files: 0 secret / DSN / api-key / private-key / IP; 0 uuid literals in 014/230/240.

DOT — PASS, 68/68

Migration 014 adds 2 tables + 3 views + 3 functions. runtime/110's SSOT inventory _iu_core_expect and the D9 verdict counts were bumped in the SAME commit (table 10→12, view 6→9, function 21→24). The D8 drift-guard table shape was extended with iu\_metadata% so the two new tables are drift-covered.

runtime/110 live scan after all changes — D9 conformance:

class	expected	found	ok
table	12	12	t
view	9	9	t
function	24	24	t
trigger	3	3	t
config	5	5	t
event_type	7	7	t
route	8	8	t

68/68 PASS, D8 drift guard 0 rows.

Five-layer sync

Layer	Impact
PG	Real change: migration 014 (2 tables / 3 views / 3 functions); runtime/230 (17 vocab + 330 derived tags); runtime/240 (11 deprecate_piece ops, 11 IUs draft→deprecated, 11 events); runtime/150 (11 dry_run attempts). All additive/idempotent.
Directus	Data-only: 11 information_unit rows lifecycle_status draft→deprecated. The 2 metadata tables are IU-core tables, not Directus collections — no collection/field DDL.
Nuxt	Render-only — deprecated IUs render with status; the three-axis read surfaces (v_iu_source_outline / v_iu_content_group / v_iu_metadata_envelope) are available to power future filter/outline UIs. No current component contract change.
AgentData / KB	This macro's 8 reports under v0.6-iu-core-120x-three-axis-metadata-delivery-autocut-textcode-open-goal/, uploaded + list/read/search-verified.
Qdrant / vector	No impact this macro — axis B stores structured derived tags, not embeddings. NOTE: the registered-but-empty topic/subject inferred lane is the intended future bridge to vector search (a later macro may populate it from an embedding pass).

Reversibility — every mutation path has a disable/rollback

• Migration 014 → rollback/014_three_axis_metadata.rollback.sql (drops all 8 objects; information_unit untouched).
• runtime/230 → runtime/rollback/230_metadata_enrichment_populate.rollback.sql (deletes the derived tags + derived vocabulary).
• The 11 deprecate_piece ops → fn_iu_structure_op_rollback(<op_id>) per op (compensation snapshot in impact_summary; the inverse is proven by the 60x macro's BEGIN…ROLLBACK rollback probe).
• iu_metadata_tag is truncatable — the derived tags rebuild from information_unit via fn_iu_metadata_refresh.
• Gates: iu_core.structure_ops_enabled / delivery_enabled / delivery_live_routes all closed/empty; master + worker gates closable.