10 — Branch J: IU Pilot Start Package (Operator-Ready)

Goal: package what's needed for the first real IU pilot day. Result: PASS — operator-ready.

1. Pilot scope (safe, bounded)

• In scope: create/read/enact a small set of new IU (≤10) via fn_iu_create → fn_iu_enact (with real review_decision via in-tx manifest), read via fn_iu_subtree/fn_iu_filter_axis_b, KG audit via new dot_iu_kg_edge_audit, structure ops (split/merge) on the pilot set only.
• Out of scope (forbidden): any 4 Mothers runtime, UI, Directus writes, vector, gate flips beyond the bounded gate protocol, production review_decision approve/reject.

2. Channels

• Read: MCP query_pg (role context_pack_readonly).
• Apply: ssh contabo → docker exec -i postgres psql -U workflow_admin -d directus -v ON_ERROR_STOP=1.
• Method: dress-rehearse each mutating step in BEGIN..ROLLBACK, COMMIT small, verify in fresh connection.

3. Pre-flight checks (run before each pilot session)

SELECT fn_iu_gate_verify_closed();                       -- expect all_safe=true, never_flip_intact=true
SELECT fn_iu_kg_edge_audit();                            -- KG coverage baseline
SELECT count(*) FROM information_unit;                    -- baseline IU
SELECT count(*) FROM dot_iu_command_run;                  -- audit baseline
SELECT value FROM dot_config WHERE key IN
 ('iu_enact.allow_no_review_decision','iu_core.vector_sync_enabled'); -- BOTH must stay 'false'

4. Pilot-day runbook (golden path)

1. Pre-flight (above) — abort if any gate unsafe.
2. fn_iu_create_plan(...) → review plan.
3. BEGIN; fn_iu_create(...); build in-tx manifest_envelope + review_decision (unit_local_id NULL) ; fn_iu_enact(...); COMMIT;
4. Verify in fresh conn: row present, lifecycle_log entry, gate still closed.
5. Read-backs: fn_iu_subtree, dot_iu_kg_edge_audit.
6. Lawful cleanup if test: fn_iu_retire (NOT delete).

5. Health checks (during)

• fn_iu_gate_verify_closed()->>'all_safe' = 'true' after every commit.
• dot_iu_command_run grows by expected count; actor matches.
• No iu_relation/universal_edges unexpected delta.
• DLQ: SELECT count(*) FROM iu_sql_route_attempt WHERE ... dead_lettered = 0 (delivery off anyway).

6. Stop conditions (abort immediately)

• all_safe=false or never_flip_intact=false.
• Any unexpected mutation to enacted IU, governance_registry, or dot_config gate keys.
• allow_no_review_decision or vector_sync_enabled found 'true'.
• Birth/structure trigger raises an unexplained error.
• Schema byte-size jumps unexpectedly between read-only sessions.

7. Evidence & reporting

• Evidence folder: knowledge/dev/reports/operations/iu-pilot-day-NN-2026-MM-DD/.
• Capture: pre/post fn_iu_gate_verify_closed, IU counts, dot_iu_command_run rows, each commit's fresh-conn verify, rollback proofs.
• Report path: …/iu-pilot-day-NN-report.md (rev1) + KB upload.

8. Operator instructions

• One operator, one session, one bounded change set.
• Never flip allow_no_review_decision/vector_sync_enabled.
• Always COMMIT small after a green dress-rehearsal; always verify in a fresh connection.
• Escalate (don't improvise) on any stop condition.

9. Next pilot-day macro

IU_PILOT_DAY_1_BOUNDED_CREATE_ENACT_READBACK_10000X — execute §4 on ≤5 new IU, full evidence, then IU_PILOT_WEEK_1_MONITORING.