50000x · 00 — PASS summary (partial pass focused subset)

Macro: IU_CORE_50000X_AUTOSCOPE_REFRESH_SCALEOUT_EVENT_OPS_CLOSEOUT Outcome: IU_CORE_50000X_PARTIAL_PASS_FOCUSED_SUBSET — E+F+G+H+I live; P1 (mig 036) authored-only / channel-blocked. Date: 2026-05-25 Repo HEAD (start): c42871a — IU_CORE_40000X_PARTIAL_PASS state. Repo HEAD (end): 6cffa59 — see 10-evidence-bundle-pointer.md. Parent baseline: IU_CORE_40000X_PARTIAL_PASS_FOCUSED_SUBSET.

Headline

Moved Product Factory from "governed DOT command vocabulary at productized boundary + retention policy registered" (40000x) → "20 durable orchestrated product instances at scale + hardened internal-only event boundary invariant + ops/UI handoff package" (50000x focused subset).

The 40000x carry-forward Phase E (durable scaleout 20–40) is now executed durably at N=20 — iu_collection_template_instance_lineage 17 → 37 and iu_auto_instantiate_event_log 13 → 33, all 20 new rows actor-tagged iu-core-50000x-bulk, all 20 digest_matches_template=true. Carry-forward Phase F (internal event boundary) is now proven by construction at three independent layers (registry lane / route table / worker gate) with a bounded BEGIN/ROLLBACK outbox probe confirming zero delivery work fires when the gate is closed. Carry-forward Phase G (UI/Ops/retention closeout) is partially closed: retention dry-run executed (rows_eligible=0 across all 4 targets, gate remains FALSE), VPS systemd timer package authored under vps-systemd/ (not installed, not started), and the operator runbook addendum is written.

Why focused subset (Auto-Scope Ladder applied without asking)

The macro's 4-objective body (D+E+F+G) was sized for a 50–60 min window. Phase D (envelope auto-refresh on auto-compose) hit a hard permission boundary on apply: the lineage table iu_collection_template_instance_lineage is owned by workflow_admin and the application connection role directus has SELECT/INSERT/UPDATE/DELETE/REFERENCES but not TRIGGER. A CREATE TRIGGER from the directus role is refused. The transaction rolled back atomically; no partial state. Per Auto-Scope Ladder (DO NOT ASK USER), the macro proceeded with the other three branches durably and packaged Phase D as authored migration 036 + rollback waiting for a workflow_admin-credentialed apply.

This is a real, evidence-backed PARTIAL PASS, not a fake full PASS.

Surface — what shipped this macro

Phase E — Durable scaleout N=20 (LIVE)

• iu_collection_template_instance_lineage 17 → 37 (+20)
• iu_auto_instantiate_event_log 13 → 33 (+20)
• iu_piece_collection 24 → 44 (+20)
• iu_piece_membership 118 → 223 (+105 = 20 instances × avg 5.25 pieces)
• All 20 actor=iu-core-50000x-bulk, all 20 digest_matches_template=true
• Mix: 5 each across 4 templates (tpl:file:status-report/v1+v2, tpl:wf:onboarding/v1+v2)
• Idempotency key: md5(event_id||':'||template_id||':'||suffix) unique per call
• Actor-scoped rollback dry_run proven addressable: 20 instances, 20 lineage rows, 20 log rows targeted, zero deletion
• In-TX gate toggle — both iu_core.composer_enabled and iu_core.auto_instantiate_enabled opened, scaleout performed, gates closed BEFORE commit. Both gates inert post.
• No information_unit row created (instance reuses template pieces) — DIEU axes 27/23/36 unchanged, Qdrant iu_core_iu_chunks=149 unchanged.

Phase F — Internal event boundary hardening (LIVE PROOF)

• Read-only proof script: event-boundary/internal_only_proof.sql
• All 3 layers GREEN at probe time:
  • L1 — event_type_registry row exists with delivery_lane='delayed' (not live)
  • L2 — iu_outbound_route and iu_sql_event_route both have zero rows keyed to this event_type
  • L3 — iu_core.delivery_enabled=false AND iu_core.delivery_live_routes=''
• Bounded BEGIN/ROLLBACK probe: inserted one event_outbox row keyed to iu.template.instance_auto_composed, observed iu_route_attempt and iu_route_dead_letter deltas = 0, ROLLBACK left zero trace in event_outbox.
• BOUNDARY_INVARIANT aggregate row returns internal_only_holds=true.

Phase G — UI/Ops closeout (LIVE + AUTHOR-ONLY)

• Retention dry-run executed via fn_iu_core_retention_cleanup('iu-core-50000x-retention-dry', TRUE):
  • All 4 retention targets reported rows_eligible=0, rows_deleted=0, dry_run=true
  • Gate iu_core.retention_enabled remains FALSE
• VPS systemd timer package authored under vps-systemd/ (.service + .timer + README) — NOT installed, NOT started.
• Operator runbook addendum written: OPERATOR_RUNBOOK_50000X_ADDENDUM.md.
• PR #669 — UNTOUCHED (this clone has no git remote; channel-unaddressable in this macro).
• Nuxt — UNDEPLOYED.

Phase D — Envelope auto-refresh (AUTHORED-ONLY)

• Migration 036 SQL + rollback authored at sql/iu-core/036_envelope_auto_refresh_on_auto_compose.sql and sql/iu-core/rollback/036_envelope_auto_refresh_on_auto_compose.rollback.sql.
• Apply blocked by permission boundary (see 02-p1-envelope-refresh-blocked.md).
• No SSOT / no test changes were committed — the live DB surface is the only source of truth and remains at the 40000x 181-object D9 conformance level.

Live regression matrix (post-mutation, against 40000x baseline)

Surface	40000x	50000x	Δ	Verdict
information_unit	175	175	0	invariant ✓
iu_collection_template_registry	4	4	0	invariant ✓
iu_collection_template_version	4	4	0	invariant ✓
iu_collection_template_instance_lineage	17	37	+20	expected ✓
iu_auto_instantiate_event_log	13	33	+20	expected ✓
iu_piece_collection	24	44	+20	expected ✓
iu_piece_membership	118	223	+105	expected ✓
iu_lifecycle_log	146	146	0	invariant ✓
iu_vector_sync_point	152	152	0	invariant ✓
event_outbox total	123460	123460	0	invariant ✓
event_type_registry	26	26	0	invariant ✓
dot_iu_command_catalog	26	26	0	invariant ✓
iu_core_retention_policy	4	4	0	invariant ✓
Qdrant iu_core_iu_chunks	149	149	0	invariant ✓
IU Core write gates inert	11 / 11	11 / 11	0	✓
Tests passing	1305	1305	0	green ✓
D9 conformance	7/7 PASS 181 obj	7/7 PASS 181 obj	0	green ✓

Authority boundary — what this macro did NOT do

• PR #669 — UNTOUCHED (no git remote in this clone).
• Nuxt — UNDEPLOYED.
• Retention — NOT ENABLED (gate stayed false; only dry-run).
• production_documents — UNTOUCHED.
• No external delivery; no daemon/cron/systemd started.
• No DB writes outside the bounded scaleout.
• No migration 036 apply.

Pre/post backups

• Pre: /root/backups/iu_core_pre_50000x_20260525T063720Z.dump (80,705,792 B; SHA256 f2d198e269914d14f88a582063416bddba5977dffec260ba186c81787b93fa5f)
• Post: /root/backups/iu_core_post_50000x_20260525T065221Z.dump (80,717,003 B; SHA256 107f361d16c4c23bb575d8f34e4102d37a5a84b7808de827ccc9940c81b8ebbf)
• Delta: +11,211 B (consistent with row deltas).