6000x — Auto-refresh PROD pilot (durable mutation)

Repo commit: 4fb380e.

Verdict: PASS — gate opened, statement-level trigger fired, audit row durably written, gate closed; envelope unchanged; zero trigger errors.

Authority: user-approved gate-true for one controlled real event.

Pre-state (live, captured 2026-05-23T14:20Z)

• iu_core.three_axis_auto_refresh_enabled = false (inert)
• iu_three_axis_envelope_refresh_log rows = 5 (most recent: id=16, actor=iu_5000x_pilot, outcome=skipped_in_sync, 2026-05-23T09:48Z)
• iu_three_axis_envelope_trigger_error_log rows = 0
• iu_three_axis_envelope rows = 163
• Drift snapshot: {"in_sync": true, "view_count": 163, "table_count": 163}

Backup taken before mutation

/root/directus-pre-iucore-6000x-20260523T140636Z.dump
sha256: 4539f312d078e166775009a991dee037fa248fb5639e19b4ad8bc4c4d3935fe6
size:   75901728 bytes (72.4 MiB)

Pilot script (durable, all-or-nothing transaction)

/tmp/auto_refresh_pilot_6000x.sql, executed inside the postgres container via SSH:

1. Capture pre-state.
2. BEGIN; SET LOCAL app.canonical_writer = 'iu_6000x_pilot';
3. Open gate: UPDATE dot_config SET value='true' WHERE key='iu_core.three_axis_auto_refresh_enabled';
4. Verify gate open in same TX → true.
5. Fire ONE real event: UPDATE iu_metadata_tag SET assigned_at = assigned_at WHERE FALSE; — zero rows touched; statement-level AFTER UPDATE trigger fires regardless.
6. Close gate inside same TX: UPDATE dot_config SET value='false' WHERE key='iu_core.three_axis_auto_refresh_enabled';
7. Verify gate closed in same TX → false.
8. COMMIT;
9. Capture post-state.

If any step inside BEGIN..COMMIT had failed, the transaction would have rolled back leaving the gate false — the pilot is safe by construction.

Post-state

• iu_core.three_axis_auto_refresh_enabled = false (closed, as designed)
• iu_three_axis_envelope_refresh_log rows = 6 (+1)
• iu_three_axis_envelope_trigger_error_log rows = 0 (no error swallowed)
• iu_three_axis_envelope rows = 163 (no data change)
• Drift snapshot: {"in_sync": true, "view_count": 163, "table_count": 163} (unchanged)

New audit row id 18

 id | actor                | outcome         | dry_run | forced | in_sync_pre | in_sync_post
 18 | iu_lifecycle_trigger | skipped_in_sync | f       | f      | true        | true
 started_at = finished_at = 2026-05-23T14:20:20.986188Z
 view_count_pre=163  table_count_pre=163  table_count_post=163

• actor='iu_lifecycle_trigger' proves the trigger payload fired (only the trigger function hard-codes this actor).
• outcome='skipped_in_sync' correct: drift in_sync=true short-circuits the refresh.
• No envelope rows were UPSERTed.

Refresh status view (post-pilot)

last_actor=iu_lifecycle_trigger  last_outcome=skipped_in_sync
current_in_sync=t  current_view_count=163  current_table_count=163
cache_healthy=t

Why this is durable, not BEGIN..ROLLBACK

5000x runtime/350 used BEGIN..ROLLBACK to prove the path without committing. 6000x ran the same code path inside BEGIN..COMMIT. End state matches BEGIN..ROLLBACK (gate closed, envelope unchanged), but the proof is now durable in refresh_log.

Constitutional check

• Reversible: gate already closed.
• No fake PASS: real trigger path, real audit row, no sandbox.
• No hardcode: actor iu_lifecycle_trigger is the trigger function's literal, not a macro string.
• No secret logging.