dot:kg Operational Dry-run Addendum (2026-06-04)

Companion to d2-dot-kg-process-family-sop-runbook-2026-06-04.md. Adds the operational, evidence-backed section now that a correlated dry-run exists. Not a source IU; an operational runbook section.

What is real today

• The dot:kg producer endpoint is a deployed, compose-managed service incomex-agent-api-executor (internal-only, loopback 127.0.0.1:8090, read_only, fail-closed). It never touches the database.
• DOT_KG_EXPLAIN is bound (mode=DRY_RUN, endpoint http://incomex-agent-api-executor:8090/dispatch).
• DOT_KG_EXPLAIN_VERIFY is the deterministic verifier (VERIFY_ONLY, endpoint NULL) — the Python twin of the DB self-check, proven 7/7 by /selfcheck.
• A correlated EXPLAIN+VERIFY DRY_RUN pair is recorded (run 703f08e4, corr dryrun-pair-20260604T084721Z): producer is_mock=false + verifier pass=true, sharing one correlation_id, birth-free, REAL_RUN=0.

How to run one correlated dry-run (operator)

1. curl -s -X POST http://127.0.0.1:8090/dispatch -d '{"dot_code":"DOT_KG_EXPLAIN","fixture_ref":"FIXTURE:dot:kg:explain:v1","correlation_id":"<corr>","mode":"DRY_RUN"}' → expect is_mock=false, verifier.pass=true, writes_db=false.
2. Record run + producer + verifier components via fn_process_run_observe / fn_process_component_observe with the same correlation_id, evidence_type=DRY_RUN. (See sql/correlated_pair.sql.)
3. Confirm v_process_discovery_verified_candidates_v3 is unchanged (a dry-run never confers verified status).

What is NOT real yet (owner-gated)

• No REAL_RUN. The runtime gate (process_dot_runtime.real_run_enabled) is false; fn_process_run_observe refuses REAL_RUN at write.
• dot:kg is not verified and not born. Verified requires a correlated REAL_RUN; birth requires the 10-process split (owner PROC-OWN-04).
• The 7 process.* events are inactive (PROC-OWN-05).

Why dry-run-first matters editorially

dot:kg is the convergence hub of the knowledge_graph topic (Điều-39). The dry-run proves the reasoning+verification contract is sound before any production graph write — the same grounding discipline the KG law requires. Content built on dot:kg can cite a working, verifiable producer, not a promise.