IU Core Production DDL — 05 Runtime-prep package

Date: 2026-05-21 · New sql/iu-core/runtime/ — authored, NOT executed.

Files authored

File	Purpose
runtime/010_event_type_seed.sql	register (iu, version_applied, update, immediate) in event_type_registry
runtime/020_route_seed.sql	seed 1 outbound + 1 inbound route, enabled=false, dry_run=true
runtime/030_trigger_attach.sql	CREATE TRIGGER trg_iu_out_version (unit_version) + trg_iu_sql_in_iu_sql_link
runtime/040_runtime_verification.sql	read-only verification, BEGIN … ROLLBACK
runtime/rollback/010..030	matching rollback / disable files, live-history guarded
runtime/README.md	activation order, master-gate flip, disable runbook

Every forward file is self-transacted and idempotent (ON CONFLICT DO NOTHING, DROP TRIGGER IF EXISTS + CREATE TRIGGER). No file enables a route or opens the master gate — those remain separate sovereign macros.

Validation

• 020 + 030 applied cleanly to the throwaway sandbox restore_test (rc 0), then reverted with rollback/030 + rollback/020 — sandbox returned to 0 iu routes / 0 iu triggers.
• 040 ran clean against production directus (read-only, ends ROLLBACK): V1–V3 empty (nothing seeded), V4 master gate <absent>/false, V5 correctly reports the H3 fix NOT yet on production, V6 empty.
• 010 is covered by the H3 probe TXN 2, which executed the identical event_type_registry INSERT against production (rolled back).

Key design finding — parallel version_applied path

unit_version already carries trg_aa_iu_notif_version → fn_iu_notif_version, which writes version_applied into iu_notification_event. The iu-core trg_iu_out_version instead writes version_applied into event_outbox. These are two sinks for the same logical event. runtime/030 documents this prominently; the runtime macro must rule explicitly on whether the event_outbox path is wanted in addition to the existing iu_notification_event path.

Activation order (for the future gated runtime macro)

0. Re-run idempotent 005 — install the H3-fixed fn_iu_emit_event.
1. 010 event-type seed. 2. 020 route seed. 3. 030 trigger attach.
2. Enable routes (separate macro — staged dry_run → live).
3. Open the master gate dot_config 'iu_core.routes_master_enabled'='true' (separate macro). Behaviour changes only at step 5.

Disable runbook

1. Close the master gate (instant, global, no DDL).
2. UPDATE … SET enabled=false per route.
3. Run rollback/030 to detach triggers (fail-closed regardless of gate).