{ "document": "authority-matrix-fresh-read-closure-bcdgh-2026-06-09", "nature": "narrow read-only fresh-read closure of blocked authority domains B/C/D/G/H; decides nothing", "production_mutation": "NO", "date": "2026-06-09", "strict_rule": "Khong chac dung = sai; counts carry denominator+query+surface+timestamp+confidence; not collapsed", "inputs_adopted_tentatively": ["A", "E", "F", "I", "J"], "evidence_mode": { "pg": "PostgreSQL16 db=directus role=context_pack_readonly READ-ONLY 5s LIMIT500 (query_pg)", "fs_mirror": { "wf_fs_dot_bin_snapshot_observed_at": "2026-06-09T02:10:15Z", "wf_fs_script_snapshot_observed_at": "2026-06-09T02:10:47Z", "note": "no new OS scan since baseline; same snapshot batch" }, "meta_scan": "CAT-006 last_scan_date 2026-06-09T06:00:00.436", "direct_os_listing": "BLOCKED (read_file allowlist excludes /opt/incomex/dot/bin and /opt/incomex/scripts; no shell)" }, "final_verdict": "FRESH_READ_CLOSURE_PARTIAL", "verdict_reasons": [ "C draft formula (186 ∩ command-catalog) refuted: join=0; needs matrix patch + Codex re-decision", "actual_count=163 filter and live OS listing are permanently UNVERIFIABLE read-only (bounded/explained)", "B/C/D still need owner/Codex decisions, not reads" ], "domains": { "B": { "title": "DOT runtime executable authority", "previous": "BLOCKED (needs fresh read)", "fresh_evidence": "operational 214 + mapped 186 (wf_fs_dot_bin_snapshot 02:10); run-ledger 55; runtime_lease 0; registry no executable bit (classification real=0); actual_count=163 external-sync, filter UNVERIFIABLE", "resolved": "evidence_resolved; can-run definition pending", "confidence": "MEDIUM", "codex_required": true, "planning_impact": "define can-run = presence(214)+proof-of-run(55); not registry, not 163, not local checkout; two residuals UNVERIFIABLE-by-design" }, "C": { "title": "DOT safe-reuse / safe-call authority", "previous": "BLOCKED (needs computed safe-call profile)", "fresh_evidence": "186 ∩ command-catalog joins to 0 on name and code; disjoint spaces (filesystem dot_tools vs fn_iu_* PG functions); computable safe read-only set exists on IU layer = 15 mutating=false (12 also reversible)", "resolved": "resolved-as-refuted; layer decision pending", "confidence": "HIGH on refutation / MEDIUM on alternative", "codex_required": true, "planning_impact": "draft C formula withdrawn; pick one call layer; filesystem 186 NOT safe to call (no exit-code/governance, coverage partial); IU read-only 15 governed but deferred in v0.1" }, "D": { "title": "Registry<->FS reconciliation contract", "previous": "BLOCKED (41 vs 4 unresolved)", "fresh_evidence": "41 = v_dot_registry_no_file (stale 06-03 recon, name-key, active/published dot-% only); 4 = v_dot_reconciliation_reliability.MISSING_FILE (fresh 06-09 snapshot, code-key, all 309). Different base+key+population.", "resolved": "evidence_resolved; canonical-base pick pending (owner)", "confidence": "HIGH", "codex_required": true, "planning_impact": "recommend canonical base = fresh code-keyed reliability view; keep 41-view as stale advisory; unmatched=NON-CALLABLE + warning; reconcilers deployed, reuse" }, "G": { "title": "Graph / duplicate / orphan authority", "previous": "BLOCKED/Partial (gap unproven)", "fresh_evidence": "graph universal_edges=2199, v_kg_edges_all=2259, entity_dependencies=142; orphan fn_dot_wf_orphan_detector(v2)+wf_orphan_digest_v2=6+queue=145+views; duplicate v_birth_duplicate_issue_guard/v_rp_dedup_signature_gap/v_system_issue_semantic_duplicate_dashboard/idempotency_guard; reconcile fn_reconcile_fk_vs_edges/rules_vs_views", "resolved": "RESOLVED", "result": "EXISTING_AUTHORITY_SUFFICIENT", "confidence": "HIGH", "codex_required": "light (confirm no-fork)", "planning_impact": "new resolver PROHIBITED; doc-level canonical-id resolver = gap NOT proven (existing engines target DB entities) -> run existing engines + show miss before any build" }, "H": { "title": "Text-as-Code corpus authority", "previous": "BLOCKED/UNRESOLVED (IU 219 vs TAC 102, no compat view)", "fresh_evidence": "0 views and 0 functions join tac_logical_unit+information_unit; 0 views reference tac_logical_unit; no tac_iu*/iu_tac* table; IU=117 fn + 11 views + 219 rows; TAC=7 fn + 0 views + 102 rows; tac_change_set=0 (TAC-internal, empty)", "resolved": "RESOLVED", "result": "NO_BRIDGE_DUAL_REPORT_ONLY", "confidence": "HIGH", "codex_required": true, "planning_impact": "tool dual-reports only; must not choose canonical; must not merge; must not build bridge; bridge/owner-decree required before any corpus consumption" } }, "counts": [ {"id": "R1", "surface": "dot_tools", "denominator": "registry rows", "count": 309, "date": "live; frozen 2026-04-02", "conf": "HIGH"}, {"id": "R2", "surface": "CAT-006 record_count/active_count", "denominator": "catalog claim", "count": "309/309", "date": "scan 06:00", "conf": "HIGH"}, {"id": "R3", "surface": "CAT-006 actual_count", "denominator": "external FS-scan field", "count": 163, "date": "scan 06:00", "conf": "HIGH value / UNVERIFIABLE filter", "note": "written by external dot-catalog-sync; no DB writer sets 163; = local web-test checkout"}, {"id": "R4", "surface": "CAT-006 baseline_count", "denominator": "baseline", "count": 151, "date": "scan 06:00", "conf": "HIGH"}, {"id": "F1", "surface": "wf_fs_dot_bin_snapshot total", "denominator": "/opt/incomex/dot/bin objects", "count": 289, "date": "snapshot 02:10 (unchanged)", "conf": "HIGH"}, {"id": "F2", "surface": "wf_fs_dot_bin_snapshot OPERATIONAL", "denominator": "live non-backup executables", "count": 214, "date": "02:10", "conf": "HIGH"}, {"id": "F3", "surface": "wf_fs_dot_bin_snapshot NOISE_BACKUP", "denominator": "backups", "count": 75, "date": "02:10", "conf": "HIGH"}, {"id": "F4", "surface": "wf_fs_dot_bin_snapshot mapped", "denominator": "operational mapped to registry code", "count": 186, "date": "02:10", "conf": "HIGH"}, {"id": "F5", "surface": "derived F2-F4", "denominator": "operational-not-mapped (file-no-registry fresh)", "count": 28, "date": "06-09", "conf": "MED"}, {"id": "S1", "surface": "wf_fs_script_snapshot total", "denominator": "/opt/incomex/scripts objects (the 42 surface)", "count": 42, "date": "snapshot 02:10:47", "conf": "HIGH", "breakdown": "32 exec-OPERATIONAL + 7 exec-BACKUP + 3 file-OPERATIONAL"}, {"id": "S2", "surface": "wf_fs_script_snapshot operational", "denominator": "operational scripts", "count": 35, "date": "02:10:47", "conf": "HIGH"}, {"id": "S3", "surface": "wf_fs_script_snapshot mapped_dot_code", "denominator": "scripts mapped to DOT", "count": 0, "date": "02:10:47", "conf": "HIGH", "note": "separate surface, not DOT"}, {"id": "L1", "surface": "v_dot_reconciliation_reliability", "denominator": "309 stratified (fresh snapshot, code key)", "count": {"DOT_EXECUTABLE_CONFIRMED": 186, "DOT_REGISTERED": 100, "DOT_HELPER_TOOL": 19, "DOT_MISSING_FILE": 4}, "date": "live", "conf": "HIGH"}, {"id": "L2", "surface": "v_dot_registry_no_file", "denominator": "registry-no-file (stale 06-03, name key, active/published dot-%)", "count": 41, "date": "live", "conf": "HIGH"}, {"id": "L3", "surface": "v_dot_fs_reconciliation", "denominator": "06-03 FS joined to registry", "count": {"OK_REGISTERED_BORN": 193, "BACKUP_in_reg": 68, "FILE_NO_REGISTRY": 16, "BACKUP_not_reg": 8, "NON_DOT_ARTIFACT": 2}, "date": "live; 06-03 base", "conf": "HIGH"}, {"id": "C1", "surface": "dot_iu_command_catalog", "denominator": "IU command bridge entries", "count": 54, "breakdown": "mutating 39 / non-mutating 15 / reversible 41", "date": "live", "conf": "HIGH"}, {"id": "C2", "surface": "dot_iu_command_catalog mutating=false", "denominator": "read-only safe-call set (IU layer)", "count": 15, "note": "12 also reversible", "date": "live", "conf": "HIGH"}, {"id": "C3", "surface": "join dot_iu_command_catalog x dot_tools", "denominator": "on name / on code", "count": "0/0", "date": "live", "conf": "HIGH", "note": "no join key; disjoint spaces"}, {"id": "X1", "surface": "dot_iu_command_run", "denominator": "run-ledger rows", "count": 55, "date": "live", "conf": "HIGH"}, {"id": "X2", "surface": "dot_iu_runtime_lease", "denominator": "active execution leases", "count": 0, "date": "live", "conf": "HIGH"}, {"id": "G1", "surface": "universal_edges", "denominator": "graph edges", "count": 2199, "date": "live", "conf": "HIGH"}, {"id": "G2", "surface": "v_kg_edges_all", "denominator": "KG edges union view", "count": 2259, "date": "live", "conf": "HIGH"}, {"id": "G3", "surface": "entity_dependencies", "denominator": "dependency edges", "count": 142, "date": "live", "conf": "HIGH"}, {"id": "O1", "surface": "dot_coverage_required", "denominator": "required-coverage rows", "count": 11, "date": "live", "conf": "HIGH"}, {"id": "O2", "surface": "wf_orphan_digest_v2", "denominator": "orphan digest output", "count": 6, "date": "live", "conf": "HIGH"}, {"id": "O3", "surface": "wf_orphan_remediation_queue", "denominator": "remediation queue", "count": 145, "date": "live", "conf": "HIGH"}, {"id": "O4", "surface": "v_registry_counts", "denominator": "registry count ledger", "count": 169, "date": "live", "conf": "HIGH"}, {"id": "T1", "surface": "information_unit", "denominator": "IU rows", "count": 219, "date": "live", "conf": "HIGH"}, {"id": "T2", "surface": "tac_logical_unit", "denominator": "TAC logical units", "count": 102, "date": "live", "conf": "HIGH", "related": {"tac_unit_version": 102, "tac_publication_member": 102, "tac_publication": 4, "tac_change_set": 0}}, {"id": "T3", "surface": "bridge search", "denominator": "views/functions joining TAC+IU", "count": "0/0", "date": "live", "conf": "HIGH", "related": {"views_ref_iu": 11, "views_ref_tac": 0, "fn_iu": 117, "fn_tac": 7}}, {"id": "I1", "surface": "system_issues by status", "denominator": "issue rows", "count": {"open": 223313, "resolved": 674, "archived": 20}, "date": "live", "conf": "HIGH", "top_source": "heal_description_basic=216378"} ], "safe_call_set_result": "PARTIAL", "safe_call_detail": { "specified_expression": "186-confirmed ∩ command-catalog-governed", "computable_as_specified": false, "join_rows": 0, "reason": "disjoint identifier spaces: 186 = filesystem dot_tools scripts (code/name); catalog = fn_iu_* PG functions (command_name->target_functions)", "computable_alternative": {"layer": "IU command-catalog", "set": "mutating=false", "count": 15, "stricter": "mutating=false AND reversible=true = 12"}, "fs186_per_entry": {"file_path": true, "registry_row": true, "fs_executable_confirmation": true, "status": true, "command_catalog_row": false, "registry_executable_bit": false, "coverage_status": "partial", "classification": "other"}, "safe_to_call_directly": {"filesystem_186": "NO (no exit-code/reversibility contract, coverage partial)", "iu_readonly_15": "YES on IU layer with governance, but deferred in read-only v0.1"}, "decision_required": "Codex/owner pick one call layer; cannot intersect" }, "tac_iu_result": "NO_BRIDGE_DUAL_REPORT_ONLY", "duplicate_graph_orphan_result": "EXISTING_AUTHORITY_SUFFICIENT", "duplicate_graph_orphan_caveat": "doc-level canonical-id resolver = gap NOT proven; existing engines target DB entities; gap-proof required before any build", "matrix_patch": { "untouched": ["A", "E", "F", "I", "J"], "F_reinforced": "fn_tac_log_checker_issue -> system_issues confirmed live (223313 open) with idempotency contract (violation_hash/coalesce_key/occurrence_count)", "B": "can-run = presence(214)+proof-of-run(55); actual_count=163 demoted UNVERIFIABLE/UNSAFE-as-denominator; PG mirror canonical-available", "C": "withdraw 186∩catalog (non-computable); target one layer; v0.1 reads not invokes; recommend IU read-only 15 if any call", "D": "canonical base = fresh code-keyed reliability view; 41-view kept as stale advisory; unmatched=NON-CALLABLE+warning; reuse reconcilers", "G": "EXISTING_AUTHORITY_SUFFICIENT; new resolver PROHIBITED; doc-level gap unproven", "H": "NO_BRIDGE_DUAL_REPORT_ONLY; dual-report; no choose/merge/build-bridge" }, "minimal_next_step": "Route this closure to Codex/owner to seal D (canonical base) + B (can-run definition), decide C by picking one call layer (186∩catalog withdrawn), and ratify G=EXISTING_AUTHORITY_SUFFICIENT and H=NO_BRIDGE_DUAL_REPORT_ONLY. No further read productive. No tool/schema/runner until seals.", "permanently_unverifiable_readonly": ["CAT-006 actual_count=163 exact filter (external dot-catalog-sync script)", "live OS listing of /opt/incomex/dot/bin and /opt/incomex/scripts (allowlist + no shell)"] }