01 — Production Survey + Identity + Backup

Target identity (positive)

Check	Value
Host	VPS vmi3080463 (ssh contabo)
Container	postgres (image postgres:16, up 4 weeks, healthy)
Role / DB	directus / directus
Version	PostgreSQL 16.13
Directus marker	directus_collections = 164 rows
IU surface	information_unit 158, unit_version 165, iu_tree_path 158

Gates before the macro

Gate	Value
iu_core.routes_master_enabled	true
iu_core.route_worker_enabled	true
iu_core.structure_ops_enabled	absent (registered CLOSED by this macro)

IU structure survey

• All 158 IUs flat — parent_or_container_ref IS NULL, iu_tree_path depth 0 for every row.
• iu_structure_operation = 0, iu_relation = 0 (greenfield).
• By doc_code: (null) 72, DIEU-35 36, DIEU-28 27, DIEU-32 23.
• Intended containment is encoded in canonical_address. DIEU-35: D38-DIEU35-ROOT -> ...-S0..S15 -> ...-S4-P1..P4 -> ...-S4-P1-1..3 etc.

Candidate selection (live discovery)

A safe reparent_piece candidate = a leaf IU, currently flat, whose canonical_address with its last -segment stripped is an existing IU.

• Child: D38-DIEU35-S4-P1-1 (5410e681-6d53-48ba-b202-076ecc857115) — leaf (0 children), lifecycle_status='draft', 1 unit_version (seq 1).
• Derived parent: D38-DIEU35-S4-P1 (3477ff71-b8a4-4dd8-b854-d86c1567ba83).

IU Gateway discovery (blocker found by the probe)

information_unit carries 6 triggers; trg_aa_iu_gateway_write_guard (fn_iu_gateway_write_guard, SECURITY DEFINER) blocks direct writes unless the session GUC named by dot_config 'iu_create.gateway.marker_key' (= app.canonical_writer) holds a value in iu_create.gateway.allowed_marker_values (was fn_iu_create,fn_iu_apply_edit_draft,fn_iu_enact). trg_iu_enacted_immut additionally freezes parent_or_container_ref of enacted IUs — the chosen candidate is draft, so unaffected. Resolution: the execution layer sets the discovered marker to fn_iu_structure_op, which runtime/120 registers in the allowlist.

Backup

pg_dump -Fc -> /opt/incomex/backups/directus-pre-iucore-structop-20260521T151127Z.dump — 74 726 211 bytes — sha256 4d07fe7cb79d54f5c05ebb90c67d9f9133e81042f3bd962fe8cb1a6fd6cb6a87.