IU Core Production DDL — 04 H3 residual closure

Date: 2026-05-21 · Gate-OPEN emit-path proof against production.

What H3 was

The sandbox restore_test lacked event_outbox / event_type_registry, so fn_iu_emit_event's gate-OPEN insert path was never exercised (gate-CLOSED no-op was proven). Production directus has both tables — the SSOT directed verifying the gate-OPEN path post-apply.

event_outbox contract discovered

• CHECK event_outbox_event_stream_check allows only (comment, review, update, birth, task, alert, health).
• CHECK event_outbox_payload_classification_check allows only (safe_metadata, restricted).
• BEFORE-INSERT trigger trg_event_outbox_type_validate → fn_event_type_validate() rejects any (event_domain,event_type) absent or inactive in event_type_registry, AND requires the row's event_stream / delivery_lane to MATCH the registry row exactly.

Defects found in fn_iu_emit_event (as authored at 4ce2667)

ID	Defect	Effect at gate-OPEN
H3-D1	inserts event_stream='workflow'	rejected — not in the 7 allowed values; registry-mismatch
H3-D2	inserts payload_classification='safe'	rejected — must be safe_metadata
H3-D3	passes uuid into text column event_subject_ref	NOT a defect — uuid→text assignment works

Proof (two transactions, both rolled back — production byte-unchanged)

• TXN 1 — register (iu,version_applied), open the master gate, call the current fn_iu_emit_event → ERROR: event_type_registry: stream mismatch — registry=update got=workflow raised by fn_event_type_validate. Runtime proof of H3-D1.
• TXN 2 — same setup + CREATE OR REPLACE the fixed function (registry-sourced event_stream/delivery_lane, safe_metadata, p_subject_ref::text) → returned a non-null id; the event_outbox row landed with event_stream=update, delivery_lane=immediate, payload_classification=safe_metadata. End-to-end proof the fix works against the live schema.
• Post-probe: event_type_registry iu rows = 0, master gate <absent>, event_outbox probe rows = 0. Nothing committed.

Fix landed (repo)

sql/iu-core/005_trigger_contracts_and_guards.sql — fn_iu_emit_event now SELECT event_stream, delivery_lane, active INTO v_reg FROM event_type_registry, inserts v_reg.event_stream / v_reg.delivery_lane, payload_classification='safe_metadata', p_subject_ref::text, and treats an inactive type as a no-op. Committed in 4601d83.

Production reconcile (deferred, gated)

Production still carries the pre-fix function body. It is harmless while the master gate is closed (fn_iu_emit_event returns NULL at the gate check). The runtime activation macro re-runs the idempotent migration 005 as its Step 0 to install the fix. runtime/040 check V5 detects whether the fix is present.

Verdict

H3 CLOSED — gate-OPEN path exercised on production; 2 real defects found and proven; fix authored, tested, committed, and proven end-to-end; D3 cleared. Residual reduced to a documented, gated one-line reconcile.