01 — Live State & SSOT Confirmation

All facts re-verified live (RO query_pg + RW ssh psql) — old reports treated as evidence, live wins.

Execution channel

• ssh contabo = root; container postgres present (+ directus, nuxt, agent-data, claude-kb, qdrant, nginx).
• RW: docker exec -i postgres psql -U directus -d directus. RO: MCP query_pg (READ ONLY role, 5s timeout, LIMIT 500 — heavy v3/v4 views must use the ssh psql channel).
• Write allowlist: /opt/incomex/docs/mcp-writes. Read allowlist: /opt/incomex/docs, /opt/incomex/dot/specs, /var/log/nginx. Host root via ssh has full FS read.
• Classification: EXECUTION_MODE.

Baseline counters (start of run)

• birth_registry = 1,158,319 · trigger_guard_alerts = 129.
• process_run_observation = 1 row · process_component_observation = 2 rows (the pre-existing SIMRUN).
• event_type_registry process.* = 7, active = 0.

Harness confirmed LIVE

• Functions: fn_process_run_observe, fn_process_component_observe, plus IU-command scaffolding fn_dot_iu_operator_runtime_enabled, fn_assert_safe_for_dot_action, fn_dot_iu_command_log.
• Runtime toggles in dot_config: process_dot_runtime.execute_enabled=false, dry_run_only=true, real_run_enabled=false. (Not a table — config rows.)
• v3 views present: candidate_status_v3, verified_candidates_v3, birth_readiness_v3, runtime_observed, runtime_gaps, etc.
• fn_process_run_observe body inspected: requires actor/candidate/correlation; REAL_RUN refused unless real_run_enabled; idempotent on idempotency_key; always injects no_execute=true into evidence_ref (structurally honest).

KG pilot pair (live)

code	engine	trigger	script_path	usage_count	last_executed	owner
DOT_KG_EXPLAIN	agent_api	on-demand	NULL	NULL	NULL	NULL
DOT_KG_EXPLAIN_VERIFY	agent_api	dual	NULL	NULL	NULL	NULL

Candidate landscape (17, via candidate_status_v3)

job:cut = verified_candidate (8 members, owner_missing). dot:kg = simulated_observed (36 members). dot:schema(34)/dot:nrm(11)/dot:collection(4)/dot:kb/dot:doc/dot:migration(3)/dot:birth/dot:gov(2) = structural. dot:api/field/script/seed/sync + wf:WF-001/002 = not_a_process (1 member each).

CHECK domains (unchanged, honest)

evidence_type ∈ {REAL_RUN, DRY_RUN, SIMULATED_DRY_RUN, BACKFILLED_EVIDENCE} — DRY_RUN is a valid value but had zero rows (no true dry-run had ever occurred). status ∈ {observed,started,step_started,step_completed,completed,failed,stuck,cancelled,orphan}.

SSOT documents 1–5 from the macro were read in full (batch_read) and corroborate the above with the single refinement in doc 02.