KB-5541

02 — Previous Package Integrity & Hash Check

3 min read Revision 1
integrityhash-checksql-packageschema-adaptation2026-06-03

02 — Previous Package Integrity & Hash Check

Prior authored SQL package (local disk) — present & hashed

Path: birth-orphan-dot-filesystem-hardening-macro-2026-06-03/sql/

File sha256
01_detector_views.sql 9a664b5064effad2ef92e2cbea5c48e4c12bf95dea99bf83196a910198564c6e
02_filesystem_reconciler.sql 38be533acb5cba11c9d7d999ccc78388c9e1e82c09bbd10c85d6fb19111f6f54
03_birth_gate_hardening.sql da5581e2496be46d8aa1bb6b52e7b9a7efd813d495641c1a18f9edad68d14b63
04_backfill_engine.sql 9cd1a02c63b23ffab19ef0bfab5ce98d7ba0eb2c0225ac5998b39fca7a28d0e5
05_governance_row_bridge.sql 91d08d58cc8d8daa495f30e5b219d113a3e2327f3d28d8a84ae595161fda8191
06_preflight_guard.sql 0519c10e784338bcdc120fd9147eb9bb6c54580d73f813d6eed396e5947626b8
99_rollback_all.sql 73ad5c51d22329d32e2fb38a86f294c6f075cba1f1b9ff50ef21d6e8a18915d3
collect_dot_bin_inventory.sh 8fda1e3131da3e408ebeb05730490ca5e8868ff55e1c5b5d328303176e204c36

All 8 files present; no missing dependency in the apply path. Note: the prior package's markdown docs (00-12) are not on local disk (KB-resident); only sql/ is local. This did not block work — SQL is the apply substrate.

Adaptations required (prior authored SQL → live schema)

Three corrections were necessary before applying; the previous SQL would have failed or under-reported:

  1. Filesystem join key. dot_tools.file_path/script_path are relative (bin/dot/…, dot/bin/…); zero rows match /opt/incomex/dot/bin/%. The reliable key is dot_tools.name == on-disk basename. Reconciler rewritten to join on basename.
  2. Backup detection. Live backups use .bak-s164c, .bak-S178…, not .bak$. Generated column and reconciler changed to detect '%.bak%' and strip \.bak.*$.
  3. Duplicate-name fan-out. 45 dot_tools.name values carry 2 rows each → naive LEFT JOIN produced 345 rows for 287 files. Reconciler uses DISTINCT ON (file_name) (prefer active/published, then lowest code) → exactly 1 row/file.

Additional refinements made this run (evidence-based, not count-cleaning):

  • Phantom classifier extended with proven synthetic markers (GEM-CHAOS, *-TEST, S169B, MANUAL-GEMINI, the 2026-03-26 chaos-seeding day) → 283 SYNTHETIC_TEST vs 6 REAL_MISSING (was naively 206/77).
  • P6 guard rewired to use the live v_object_owner_gap + governance_object_ownership (P5 row-bridge intentionally NOT applied) and to fail closed on a missing fs snapshot.

The final applied SQL is operator_bundle/01_apply_minimum_safety_net.sql (sha256 20b379b43db2c98cac34829b013c81003f31d3acf91c68dc4cbab741bfed7af4), rollback operator_bundle/99_rollback_minimum_safety_net.sql (sha256 0a4e1acfedbb3f3a31d9842b6d8f003fefe708a8f23ef37ead1e68715525e9ee). Full bundle hashes are in doc 12.

Back to Knowledge Hub knowledge/dev/reports/architecture/birth-orphan-safety-net-operator-apply-backlog-triage-2026-06-03/02-previous-package-integrity-and-hash-check.md