Operator Runbook — 70000x addendum

What 70000x changed

1. mig 036 LIVE. Added 1 statement-level AFTER INSERT trigger + 1 trigger payload function. Gate iu_core.three_axis_auto_refresh_enabled is false — trigger installed but inert.
2. Six-flow test runner. New ops/iu-core-six-flow-test-readiness/ directory with bash runner + 6 SQL test files + README + matrix + runbook + DOT plan.

How to run the six-flow tests

cd ~/iu-cutter-build/repo/iu-cutter/ops/iu-core-six-flow-test-readiness
SSH_HOST=contabo ./run_six_flow_tests.sh

Exit code 0 = all PASS. Exit code 1 = at least one FAILed.

How to enable envelope auto-refresh (gate flip)

DO NOT run without explicit operator sign-off.

ssh contabo "docker exec -i postgres psql -U directus -d directus -c \
\"UPDATE dot_config SET value='true' WHERE key='iu_core.three_axis_auto_refresh_enabled';\""

To re-disable:

ssh contabo "docker exec -i postgres psql -U directus -d directus -c \
\"UPDATE dot_config SET value='false' WHERE key='iu_core.three_axis_auto_refresh_enabled';\""

When the gate is true, every INSERT into iu_collection_template_instance_lineage (one statement per INSERT batch) triggers fn_iu_three_axis_envelope_refresh_if_stale with actor iu_auto_instantiate_trigger. The trigger swallows exceptions into iu_three_axis_envelope_trigger_error_log so the orchestrator's INSERT is NEVER aborted by envelope state.

How to rollback mig 036

cat sql/iu-core/rollback/036_envelope_auto_refresh_on_auto_compose.rollback.sql | \
  ssh contabo "docker exec -i postgres psql -U workflow_admin -d directus -v ON_ERROR_STOP=1"

Then revert the SSOT/pinning bumps from 66/7/183 → 65/6/181 in a new commit.

How to verify D9 conformance after a change

cat sql/iu-core/runtime/110_iu_core_dot_conformance_scan.sql | \
  ssh contabo "docker exec -i postgres psql -U directus -d directus -v ON_ERROR_STOP=1 -q"

Look at D9_conformance rows at the bottom — every class should report ok = t. If any class disagrees, SSOT and live DB have drifted — investigate before proceeding.

How to restore from the 70000x pre-macro backup

ssh contabo "ls -la /opt/incomex/backups/iu-core-70000x/"
# pre-70000x-20260525T073730Z.dump  (80,859,950 B, sha ccf1a2bd…)
# post-70000x-20260525T082243Z.dump (80,862,539 B, sha feb81437…)

# DESTRUCTIVE — restore wipes the database; use only with explicit sign-off
ssh contabo "docker cp /opt/incomex/backups/iu-core-70000x/pre-70000x-20260525T073730Z.dump postgres:/tmp/ && \
  docker exec -i postgres pg_restore -U workflow_admin -d directus --clean --if-exists -j 4 /tmp/pre-70000x-...dump"

What NOT to do

• Do NOT run production_documents mutations.
• Do NOT enable iu_core.delivery_enabled without explicit operator sign-off.
• Do NOT enable iu_core.retention_enabled (still off by constitution).
• Do NOT merge PR #669.
• Do NOT deploy Nuxt.
• Do NOT run any test that requires --no-verify or skips audit guards.