04 — True DRY_RUN One KG Pair (Workstream C)

Outcome: NOT executed — exact blocker (unchanged, now external-classified)

Mandatory conditions vs reality

condition	status
plan/verify-only runner exists	✅ fn_process_agent_api_dispatch (validation only)
fixture exists + sound	✅ FIXTURE:dot:kg:explain:v1; self-check 7/7 this run
output to DRYRUN-NS:	✅ enforced
no production writes	✅ enforced
event emission inactive	✅ 0 emitted
verified remains false	✅
real agent_api producer endpoint exists	❌ endpoint_ref NULL; no executor service/route/credential on VPS

Decision

Do not run. The dispatcher refuses DRY_RUN while endpoint_ref IS NULL. The only way to produce a DRY_RUN row today is to hand-improvise the EXPLAIN narrative and label it as the DOT having run — a MOCK mislabelled as a dry-run. Forbidden. 0 DRY_RUN and 0 REAL_RUN observations preserved.

What advanced anyway (verify side)

The verifier's deterministic checks were proven implementable and correct against the real fixture (fn_dryrun_fixture_selfcheck, doc 02). This means: only the producer invocation is missing. When the producer endpoint exists, the producer emits a candidate explanation, this checker verifies it, and both halves of the pair have a real basis for a DRY_RUN observation.

Exact next command (once the producer endpoint is bound)

SELECT fn_process_agent_api_dispatch('DOT_KG_EXPLAIN', '<corr>', 'agent', 'DRY_RUN', true, '<root>');

— with the executor wired behind it, then upgrade the observation from SIMULATED_DRY_RUN to DRY_RUN, and run the verifier check on the produced output.

Honesty posture

System still has 0 DRY_RUN / 0 REAL_RUN. verified_candidates_v3 = only job:cut. No fake.