03 — Non-reparent Structure Ops + IU Birth-gate Handshake

Migration 012 — six-operation execution layer

012_non_reparent_structure_ops.sql extends fn_iu_structure_op_apply, _verify and _rollback from "reparent only" to the full six-operation vocabulary. CREATE OR REPLACE FUNCTION only — 3 functions, no table/trigger touched. The reparent_piece path is byte-for-byte the migration-011 body; only new branches were added. Applied to production gate-closed → the new code paths are unreachable in normal operation.

operation_type	what apply does	reversible by
reparent_piece	(unchanged) move one adjacency pointer	restore prior parent
add_new_piece	mint 1 IU via birth gate + contains edge	soft-delete the minted IU
deprecate_piece	lifecycle_status → 'deprecated'	restore prior lifecycle
split_large_piece	1 source → N minted pieces + split_from + deprecate source	soft-delete pieces, restore source
merge_small_pieces	N sources → 1 minted piece + merged_from + deprecate sources	soft-delete piece, restore sources
replace_piece	1 source → 1 minted piece + replaced_by + deprecate source	soft-delete piece, restore source

The IU birth-gate handshake

The no-ungoverned-IU guarantee: every operation that creates IU identity does so only through public.fn_iu_create — the governed birth gate (preflight, vocabulary-default resolution, canonical_address advisory lock, information_unit + unit_version + version anchor, birth-invariant verify). Migration 012 never INSERTs information_unit directly.

The handshake contract: the structure op carries a birth spec per new piece in payload->'new_pieces' — an array of {canonical_address, title, body, unit_kind, section_type}. apply passes each spec to fn_iu_create and records the real minted id in impact_summary.created_unit_ids. unit_kind/section_type are required — the live vocabulary has two unit kinds (law_unit, design_doc_section) and fn_iu_create refuses an ambiguous default.

Reversibility

fn_iu_structure_op_rollback non-reparent inverse: restore every deprecated source's prior_lifecycle, retire every lineage edge in relations_written, soft-delete (deleted_at = now()) every minted IU — dropping it out of v_iu_tree — and delete its iu_tree_path row. Full compensation snapshot in impact_summary.

Proof — sandbox/070 (BEGIN…ROLLBACK, zero durable rows)

sandbox/070 runs the full envelope on the production schema inside one aborted transaction. Sources are real flat draft IUs (D38-DIEU28-ROOT/S0/S1); minted pieces use synthetic __sbx070__-prefixed canonical addresses.

Probe	Result
P1 add_new_piece apply	ok=true, birth gate minted 1 IU, event_emitted=true
P2 deprecate_piece apply	ok=true, prior_lifecycle=draft → deprecated
P3 split_large_piece apply	ok=true, 2 pieces minted, 2 relations, event emitted
P4 merge_small_pieces apply	ok=true, 1 piece minted, 2 merged_from, event emitted
P5 replace_piece apply	ok=true, 1 piece minted, 1 replaced_by, event emitted
P6 verify	all 5 ops verify ok=true
P7 rollback add_new_piece	ok=true, 1 IU soft-deleted; verify ok=true created_live=0
P8 events	5 structure_* event-family rows emitted (1 each)
P9 autocut	autocut-mapped add_new_piece now apply ok=true + verify ok=true

ROLLBACK — zero durable rows. No non-reparent structure op was durably enacted on production. Rollback file: rollback/012 restores reparent-only function bodies.