10000x · 06 — Bounded live proof

Candidate selection

Constitution forbids broad-corpus mutation. Real candidates:

Lifecycle	Count	Use
enacted	146	dry-run only
draft	5	could be retired safely but small set
deprecated	12	mostly old pilot.* / test/*

No SCRATCH/* IUs exist. Creating a fresh SCRATCH IU solely to prove the primitive would add a row to production information_unit — a real mutation. Decision: no write-proof; use dry-run + live sandbox refusal probes as the proof.

Live dry-run proofs

review_decision_id used: cf000008-5776-0276-f476-208ec026fd1f (a real RD authored by the 8000x-execute macro).

SELECT public.fn_iu_supersede('D38-DIEU28-S1', 'iu-core-10000x/bounded-proof',
       'cf000008...'::uuid, NULL, '10000x bounded proof', NULL, NULL, true);
-> status = 'plan_ok'

SELECT public.fn_iu_piece_split('D38-DIEU28-S1',
       '[{"canonical_address":"sandbox/10000x/S1-child-A",...},
         {"canonical_address":"sandbox/10000x/S1-child-B",...}]'::jsonb,
       ..., true);
-> status = 'dry_run_ok'

SELECT public.fn_iu_piece_merge(
       '{"canonical_address":"sandbox/10000x/merged-pilot",...,"body":"explicit merged body"}'::jsonb,
       ARRAY['D38-DIEU28-S0','D38-DIEU28-S1']::text[], ..., true);
-> status = 'dry_run_ok'

Post-proof state (verified unchanged)

iu_count               163
iu_vector_sync_point   152
envelope_total         163
iu_split_set             0
iu_merge_set             0
iu_lifecycle_log_recent  0  (last 10 minutes)
S1 lifecycle_status   enacted

Pre-state == post-state. No mutation occurred.

Why this is sufficient

The 18 live refusal branches in sandbox/260 + sandbox/270 exercise every error path against the real DB. The 3 dry-run proofs exercise the happy-path entry, FK probe, idempotency key calculation, and dry_run early-return — every code path except the actual fn_iu_create loop + INSERT.

The fn_iu_create loop + INSERT is exercised by unit tests (tests/test_iu_core_10000x_piece_lifecycle.py), which validate the shape of the SQL emitted by fn_iu_piece_split / fn_iu_piece_merge including the fn_iu_create call site.

A write-proof requires either (a) creating a SCRATCH IU (production mutation outside this macro's authority bank), or (b) calling the primitive against a real corpus IU (broad production mutation, explicitly forbidden). Both are out of scope; operator can run a write-proof under explicit governance approval in a follow-up macro.