01 — Macro and gates (2400x)

1. Macro identity

IU_CORE_2400X_DIRECTUS_TABLE_PROMOTION_AND_FULL_QDRANT_REINDEX

Two coordinated slices, both shipped end-to-end:

• Slice A — Directus table promotion. Promote v_ui_iu_three_axis_envelope to a managed read table (iu_three_axis_envelope) so Directus v11 can register it via the normal field-management path. Closes the 2000x POST /fields 403 blocker on view-backed schema=null collections.
• Slice B — Full Qdrant reindex. Scale from 6 points / 5 IUs to the full embeddable corpus (60 enacted IUs / 61 points; one IU split into 2 chunks under the per-IU boundary).

2. Host + tools

• MacBook (Nguyens-MacBook-Air.local, arm64) at /Users/nmhuyen/iu-cutter-build/repo/iu-cutter (branch main, HEAD before = a71d225, HEAD after = the table-promotion commit).
• Local: git, python3 3.13, psql 17, pg_dump 17, ssh.
• VPS: contabo → vmi3080463 (38.242.240.89). Containers: incomex-directus (Directus 11.5), postgres (Postgres 16), incomex-qdrant, incomex-agent-data. All healthy.

3. Discovery-first inventory (pre-mutation baseline)

• Migrations 001–021 + runtime 010–310 applied.
• DOT 128/128 PASS (config 8, event_type 15, function 47, route 16, table 19, trigger 3, view 20).
• information_unit 163 rows (60 enacted / 91 draft / 12 deprecated).
• v_ui_iu_three_axis_envelope 163 rows.
• Qdrant iu_core_iu_chunks 6 points (5 unique IUs, KT-B split).
• iu_vector_sync_point 9 rows total (3 dryrun grandfather + 6 indexed from the 2000x bounded apply).
• iu_qdrant_collection_registry 1 row (iu_core_iu_chunks, status='active' after this macro's runtime).
• directus_collections has v_ui_iu_three_axis_envelope row from 2000x (replaced by iu_three_axis_envelope in this macro).
• Gates pre-macro (all closed except master + worker): composer_enabled=false, delivery_enabled=false, operator_runtime_enabled=false, structure_ops_enabled=false, vector_sync_enabled=false, routes_master_enabled=true, route_worker_enabled=true.

4. Mandatory gates BEFORE production mutation (all PASS)

#	Gate	Result
G1	Host = MacBook + psql + pg_dump + SSH	PASS
G2	Target identity = directus DB on postgres container, vmi3080463	PASS
G3	Fresh pg_dump -Fc backup before any mutation	PASS — see G3 below
G4	DOT 128/128 baseline read-only PASS	PASS
G5	Candidate scope = live discovery (envelope + unit_version)	PASS — no hardcoded list
G6	Operation bounded + reversible	PASS — migration 022 has rollback file; Qdrant points addressable by UUIDv5
G7	Disable / cleanup path enumerated	PASS — see doc 05 §1 row 12
G8	Vector sync cannot cross IU boundary	PASS — 3-layer enforcement intact
G9	Qdrant secret / embedder not hardcoded	PASS — discovered via v_iu_qdrant_collection_active + container env
G10	Directus registration read-only + reversible	PASS — DELETE /collections/<name> is the disable
G11	Promotion does not create a second source of truth	PASS — view is the SSOT for projection logic; table is a refreshable derived cache

G3 backup anchor: /opt/incomex/backups/directus-pre-iucore-2400x-20260523T061016Z.dump

• size: 77 428 884 bytes
• sha256: 4e83efe057e38f2676bf6cee755d8ce52257be5f77e3717cab97461d185218e0

5. Approved mutation envelope (this macro)

#	Change	Status
1	Migration 022 — iu_three_axis_envelope table + 2 fns + 1 view	APPLIED (live)
2	Runtime 320 — initial refresh of the table	APPLIED (163 upserts, in_sync)
3	Directus collection swap: v_ui_... retired, iu_three_axis_envelope registered	APPLIED
4	Directus field registration (16 fields)	AUTO-DETECTED (Directus picked them up from the table — POST returned exists for all 16; no field-spec drift)
5	Directus READ permission for Administrator policy	APPLIED
6	Qdrant bounded reindex: 5 → 60 unique IUs (6 → 61 points)	APPLIED
7	iu_vector_sync_point indexed rows	6 → 61 (one row per upserted point)
8	dot_config gate toggles (vector_sync_enabled)	flipped open inside try/finally, closed at end

6. Not approved (and not done)

• No destructive vector reindex.
• No cross-IU embedding chunks.
• No external workflow delivery.
• No Nuxt code change.
• No CI/cron activation.
• No hardcoded secret or connector literal.