IU Core Runtime Activation E2E — 07 Structure-ops proof + finding H4

All proofs ran inside BEGIN … ROLLBACK — nothing committed. Structure-ops exercised the iu-core sidecar tables using real information_unit ids only as read-only FK anchors. Anchors: 4 draft IUs (D38-DIEU28-ROOT/S0/S1/S10) and 1 enacted IU (ICX-CONST/DIEU-0).

SECTION 4 / 4b — structure-ops lineage — 14/14 PASS

• 4.1 add_new_piece op envelope + contains(parent→child) edge.
• 4.2 duplicate idempotency_key rejected (unique_violation) — re-run safe.
• 4.3 op lifecycle draft → planned → enacted accepted.
• 4.4 enacted op with NULL enacted_at rejected.
• 4.5 second active contains parent for one child rejected (one-active-parent partial unique index).
• 4.6 self-relation rejected (no_self_chk).
• 4.7 split_large_piece op + 2 split_from lineage edges.
• 4.8 merge_small_pieces op + 2 merged_from lineage edges.
• 4.9 deprecate_piece op + supersedes lineage edge.
• 4.10 reparent_piece op envelope.
• 4b.1 compensation: roll the op back, retire its contains edge (relation_status='retired', valid_to=now()) → a fresh active contains for the same child is then accepted (slot freed).
• 4b.2 retired edge retained with valid_to — no hard delete.
• 4b.3 iu_tree_path depth-0 root + depth-1 child rows created.
• 4b.4 wrong-endpoint path rejected (endpoints CHECK).

SECTION 5 / 5b — parent-child tree + cycle prevention — 9/9 PASS

A temporary p→c→g chain built over draft IUs (rolled back; gateway marker set to satisfy fn_iu_gateway_write_guard on information_unit).

• 5.1 fn_iu_tree_assert_acyclic(_,NULL) no-op (reparent-to-root safe).
• 5.2 self-parent reparent rejected.
• 5b.0 temp chain built.
• 5b.1/5b.2 v_iu_tree depth = 1 (child), 2 (grandchild) — multi-level recursion.
• 5b.3/5b.4 fn_iu_tree_is_descendant(root,grandchild)=true, (grandchild,root)=false.
• 5b.5 cyclic reparent (root under grandchild) rejected — descendant detection.
• 5b.6 genuine reparent (grandchild → root) accepted.

Total behaviour + structure-ops proof: 33/33 PASS.

FINDING H4 — iu_structure_operation_enacted_chk defect

SECTION 4 (step 4.11) hit a real DDL defect. The 004 constraint (operation_status = 'enacted') = (enacted_at IS NOT NULL) makes the documented enacted → rolled_back transition impossible unless enacted_at is nulled — destroying the audit record of WHEN the op was enacted. The Python contract (OPERATION_STATUS_TRANSITIONS) allows enacted → rolled_back; the SQL CHECK contradicted it.

Fix (committed 5de52d8)

• 004 patched in-place — CHECK is now (enacted_at IS NOT NULL) = (operation_status IN ('enacted','rolled_back')).
• New migration 006_structure_op_enacted_chk_fix.sql — idempotent DROP CONSTRAINT IF EXISTS + ADD CONSTRAINT reconcile for databases that applied 004 before the patch (production directus). + rollback/006.
• 006 is NOT applied to production this macro — deferred to the next macro. Latent/harmless: iu_structure_operation is empty and the master gate is closed.
• Tests 536 → 542 (+6, new TestStructureOpEnactedChkFix).