IU Core — 500x DOT one-command composer production closeout — Final report

• Macro: IU_CORE_500X_DOT_ONE_COMMAND_COMPOSER_PRODUCTION_CLOSEOUT_OPEN_GOAL
• Date: 2026-05-22
• Host: MacBook/dev /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
• Production: VPS vmi3080463, container postgres (postgres:16), DB directus
• Outcome: IU_CORE_500X_DOT_ONE_COMMAND_COMPOSER_PRODUCTION_CLOSEOUT_PASS

1. Final status

The 480x production-apply gap is closed and the operator surface is hardened. Migration 016 + runtime/260 + runtime/270 + migration 017 are all durably applied to the production directus DB; DOT is 106/106. Along the way sandbox/110, un-runnable in the 480x session, was executed for the first time and exposed a real composer-event idempotency defect — found and fixed before any composer event was emitted durably. No unsafe production state exists.

2. What changed

• Production (durable): migration 016 (2 fn / 2 views / 4 composer fns re-wired), runtime/260 (8 event types + 8 routes, delayed lane), runtime/270 (1 collection + 2 birth-gate IUs + 2 memberships + 4 events), migration 017 (2 governed piece-disposal fns). information_unit 158→160.
• Repo: 017_dot_operator_surface.sql (+rollback), sandbox/120, dot_commands.py (the operator surface), runtime/260 + sandbox/110 lane-corrected, runtime/110 DOT 104→106, composer.py COMPOSER_COMMANDS 12→17, test_iu_core_500x_operator_surface.py, 5 DOT-count test files.

3. Repo / branch / HEAD

Branch main; HEAD f1349b3 → code cd07c2e → KB 5edd132. No push / merge / tag.

4. Production backup + gates

Gate 3 PASS — pg_dump -Fc /opt/incomex/backups/directus-pre-iucore-500x-20260522T083543Z.dump, 75,979,656 bytes, sha256 d800f6d539970b10b4e58066092318892ae6871303222c4a91c85448544ee5db, valid PGDMP (3113 TOC entries). All 14 mandatory gates PASS. See doc 01.

5. 480x state verification

Production verified at the 240x surface (84/84, 480x objects absent, 240x pilot intact, 7 480x AgentData reports present, 843 tests) — no repair needed. See doc 01.

6. Production apply — 016 / 260 / 270 / 017

016 → 2 fn + 2 views. 260 → 8 event types + 8 routes (R1/R2 pass). sandbox/110 → 9/9 after the lane fix. 270 → durable collection iu_core.composer.scratch-file-001, 2 IUs minted, 4 composer events (1 created + 2 piece_added + 1 rendered). 017 → 2 governed fns. DOT: 84 → 104 → 106. See docs 02–03.

7. The composer-event lane defect

event_outbox's partial unique index idx_event_outbox_idempotent … WHERE delivery_lane='immediate' deduped every composer delta after the first (all share event_subject_ref = the collection id). Fixed by registering the family on the lane-agnostic 'delayed' lane. sandbox/110 4-fail → 9/9. See doc 02.

8. DOT one-command operator surface

dot_commands.py — 17 dot_iu_* commands resolving to ready-to-run governed SQL. The three piece-disposal verbs are crisply distinct: remove from collection / retire globally / soft-delete with rollback. Migration 017 added the missing governed soft-delete pair. See doc 03.

9. Piece / file / workflow / text-as-code

Create-file-from-pieces, workflow-from-steps, add/remove/reorder/validate/ render, metadata-axes refresh — all proven (sandbox/110, sandbox/120, runtime/270). Text-as-code roundtrip byte-identical on the new composed collection (79d66938…). See doc 04.

10. Delivery / events / observability

Route worker run: 4 composer events → 4 dry-run attempts, 0 sent, 0 dead-lettered. External delivery structurally impossible. 5 observability surfaces live. See docs 02, 05.

11. Rollback / disable readiness

rollback/016, runtime/rollback/260, runtime/rollback/270, rollback/017 all present; disable via the master gate or composer gate; soft-delete reversible by dot_iu_restore_piece. See doc 05.

12. Tests

879 passed (was 843; +36 in test_iu_core_500x_operator_surface.py; 5 DOT-count test files updated for the 84→106 inventory).

13. KB / AgentData reports

7 reports under v0.6-iu-core-500x-dot-one-command-composer-production- closeout-open-goal/, uploaded to AgentData and verified by list_documents + get_document + search_knowledge.

14. Exact blockers

None. Every approved branch completed durably. dot_iu_clone_piece resolves to the fn_iu_create birth gate (IU body lives in the content layer — clone = author a governed new piece, content supplied); a content-copying clone is noted as a future refinement, not a blocker.

15. No forbidden action

No external downstream delivery; no production CUT; no destructive text-as-code import; no broad lifecycle mutation; no ungoverned IU creation (the 2 minted IUs went through fn_iu_create); no destructive cleanup; no deploy / restart; no daemon; no cron; no execution_enabled flip; no secret logged; no push / merge / tag. GPT handoff not used as task input.