IU Core — 500x durable auto-cut + operator mutation — Final report

• Macro: IU_CORE_500X_DURABLE_AUTOCUT_OPERATOR_MUTATION_TEXTCODE_OPEN_GOAL
• Date: 2026-05-22
• Host: MacBook/dev /Users/nmhuyen/iu-cutter-build/repo/iu-cutter
• Production: VPS vmi3080463, container postgres (postgres:16), DB directus
• Outcome: IU_CORE_500X_DURABLE_AUTOCUT_OPERATOR_MUTATION_PASS

1. Final status

IU Core moved from "operator runtime read-only-proven + integrated auto-cut proofed in sandbox" to two durable production firsts: the first DURABLE integrated auto-cut → composer run, and the first durable mutating apply through OperatorRuntime. Both are governed, bounded, reversible. DOT stays 113/113. No unsafe production state exists; no forbidden action taken.

2. What changed

• Production (durable): runtime/290 — +3 birth-gate information_unit, +1 iu_piece_collection (file/draft), +3 iu_piece_membership, +5 composer event_outbox rows. The OperatorRuntime proof — +7 dot_iu_command_run ledger rows, +3 composer events from the apply path. One worker dry-run — +8 iu_route_attempt (dry_run).
• Repo: runtime/290_durable_autocut_composer_run.sql (+rollback), tests/test_iu_core_500x_durable_autocut.py (+27), the exported iu-tree/_collections/file/iu_core.autocut.file-001.md manifest, two committed proof drivers (operator_runtime_durable_proof.py, text_as_code_roundtrip_proof.py), 7 KB reports.
• AgentData: the prior macro's 7 reports had their 500x/540x title+tag mismatch repaired (revision 1→2, content preserved byte-identical).

3. Repo / branch / HEAD

Branch main; HEAD 0985cd0 → 7e3638a (code) → 39093de (KB). No push / merge / tag.

4. Production backup + gates

Gate 3 PASS — pg_dump -Fc /opt/incomex/backups/directus-pre-iucore-500x-durable-20260522T112557Z.dump, 76,196,481 bytes, sha256 6527301b77a7d051495088ceffed0590eda20943efcbdb4b632bdf6d48452cab, valid archive (3159 entries). All 16 mandatory gates PASS. See doc 01.

5. 500x state verification + 540x naming repair

Production verified at the 500x integrated-autocut/operator-runtime surface (DOT 113/113, iu=160, coll=2, catalog 17, ledger 4, sandbox/130 9/9, sandbox/140 6/6, 932 tests) — no production repair needed. The prior macro's 7 AgentData reports carried 540x titles/tags under a 500x directory; normalised to the canonical 500x label, no duplicate created, verified via list_documents + search_knowledge. See docs 01, 05.

6. Durable integrated auto-cut → composer run

runtime/290 — a synthetic 3-section auto-cut driven through fn_iu_compose, 3 birth-gate IUs minted into collection 16ba77a5… (iu_core.autocut.file-001, file/draft, digest 3d51e759…). iu 160→163, coll 2→3, membership 5→8. Composer events 1 collection_created + 3 piece_added + 1 collection_rendered, all 'delayed'. No uncontrolled CUT. See doc 02.

7. Durable mutating OperatorRuntime apply

operator_runtime_durable_proof.py drove a 7-step proof on the runtime/290 collection — plan / apply(reorder) / verify / apply(checkpoint) / apply(reorder back = compensation) / verify / apply(refused). The first durable mutating apply (step 2) and its proven compensation (step 5). 7 ledger rows, actor runtime_500x_op_proof; dot_iu_command_run 4→11. Both gates closed at end. See doc 03.

8. Proven dot_iu_* commands

dot_iu_create_file_from_pieces (→ fn_iu_compose, runtime/290), dot_iu_reorder_piece (apply ×2 + plan + refused), dot_iu_checkpoint _collection (apply), dot_iu_validate_collection (verify ×2) — all governed, all ledger-audited.

9. Text-as-code roundtrip / import proposal

text_as_code_roundtrip_proof.py over the durable collection: Python-computed digest matches the SQL-stored manifest_digest; manifest exported to iu-tree/_collections/file/; roundtrip byte-identical; validate clean; diff = one added path; propose_collection_import acceptable=true, executes=false, IMPORT_IS_DESTRUCTIVE=False. See doc 04.

10. Composer events / worker / no dedupe regression

8 composer events for the new collection, 8 distinct ids, all 'delayed' (collection_created/piece_added/collection_rendered/piece_reordered). One worker dry-run: seen=8, attempts_written=8, dead_lettered=0. iu_route_attempt 60→68, dead-letter open 0. No dedupe regression. External delivery structurally impossible. See doc 05.

11. DOT / no-hardcode / five-layer / observability

runtime/110 113/113 before and after — the macro adds data, not production-visible objects. No-hardcode PASS across runtime/290 + both proof drivers. Five-layer classified — PG real/additive, Directus none, Nuxt render-only, AgentData 7 reports + repair, Qdrant manifest carried. See doc 05.

12. Rollback / disable readiness

runtime/rollback/290 (soft-delete 3 IUs, drop collection); the reorder is self-compensating (step 5 ran the inverse durably); 7 proof ledger rows deletable by actor; full gate-close disable path. See doc 05.

13. Tests

959 passed (was 932; +27 in test_iu_core_500x_durable_autocut.py). DOT inventory unchanged at 113 — no DOT-count test file needed editing.

14. KB / AgentData reports

7 reports under v0.6-iu-core-500x-durable-autocut-operator-mutation-open-goal/, plus 2 proof drivers, uploaded to AgentData and verified by list_documents + get_document + search_knowledge.

15. Exact blockers

None. Every approved branch of this macro completed durably. No carried production-apply gap.

16. No forbidden action

No external downstream delivery; no uncontrolled production CUT; no destructive text-as-code import; no broad lifecycle mutation; no ungoverned IU creation (every piece via the fn_iu_create birth gate); no destructive cleanup; no deploy / restart; no daemon; no cron; no execution_enabled flip; no secret logged; no push / merge / tag. GPT handoff not used as task input.