05 — DOT · no-hardcode · five-layer · acceptance matrix

1. DOT — 121 → 123

runtime/110 after migration 020: 123/123, every D9 class ok=true, D8 drift 0. Added: view v_ui_iu_three_axis_envelope (17→18), function fn_iu_vector_sync_record_v2 (44→45). Tables stay at 18 (columns added on iu_vector_sync_point, not new tables). Live DOT scan on production post-apply: 7/7 D9 ok=true, D8 drift 0.

2. No-hardcode — PASS

Comment-excluded review over 4 new/changed files: no DSN, password, IP, container, host, :5432 literal. Qdrant secret read by name only (QDRANT_LOCAL_API_KEY), never logged. Embedder key (OPENAI_API_KEY) same. Every classifier vocab joined from iu_metadata_tag_registry or information_unit, not typed into view.

3. Five-layer sync

PG: durable additive (6 cols + CHECK + 1 fn + 1 view); 0 IU data changed (iu=163, coll=3, membership=8, cmd_run=18, change_log=56, dryrun points=3, lease=0). Directus: none yet — view is Directus-ready but binding step deploy-gated. Nuxt: none. AgentData: 7 reports uploaded+verified. Qdrant: connector boundary tightened code+DB; no external write.

4. Acceptance matrix — Miếng Thông Tin Core

19 capability rows, of which 17 DONE, 1 DONE_WITH_EXTERNAL_BLOCKER (Qdrant external write — embedder + dedicated collection), 0 PARTIAL, 0 BLOCKED. Covers: cut to pieces, create from scratch, file/workflow from pieces (composer), add/remove/reorder/retire/soft-delete, original-text reconstruction (A), semantic/content (B), hierarchy (C), three-axis metadata, text-as-code export/diff/apply (non-destructive), OperatorRuntime governed plan/apply/verify + concurrency lease, internal delivery batched+idempotent+dead-letter, vector boundary rule per-IU, vector sync substrate+dryrun+drift, UI/API/operator read views+CLIs, UI Directus assembly contract, DOT/no-hardcode, rollback/disable, AgentData report integrity, F-1k-1 closed, F-960x-1 closed.

5. Acceptance hardening checks — all PASS

no-hardcode (0 real violations), DOT scan 123/123, five-layer classified, rollback drill (rollback/020 drops CHECK+6 cols+1 fn+1 view), disable drill, hashed backup 3181 entries, event idempotency (S5/S7), dead-letter open=0, vector boundary 8/8, concurrency lease 7/7, three-axis envelope 163 rows, tests 1045 pass (+25).

6. Rollback / disable readiness

Code/DDL: rollback/020 drops view + v2 fn + CHECK + 6 cols, reverting to 121. Gates: close vector_sync_enabled (019 gate). Data: 3 pre-020 dryrun points stay (grandfather lane); no new rows from this macro; lease table empty.

7. Completion ruling

IU Core is functionally complete. External integration remaining: Qdrant external write (embedder + IU Core collection), Directus collection registration, Nuxt screen wiring. All deploy/secret-gated outside this repo. None is a core gap.