03 — Canonical Production Rollout Sequence

One canonical, tiered rollout. Tiers adjusted from the mission's idealized list to match the real dependency graph (all structure must precede all seeds; the scanner function and views must exist before any scan or read). Mapping to the mission's Tier 0–8 is given at the end.

All mutating tiers are single BEGIN..COMMIT, self-guarding (db=directus + ospa>=1), idempotent, and assert their post-state before COMMIT. The executor (prod/99_run_all.sql) chains them with ON_ERROR_STOP so the first failure aborts the run.

Tier	File	Input	Expected delta	Stop gate (abort if…)	Verify	Rollback
0 Preflight/Gate	00_preflight.sql	— (read-only)	none	db≠directus / ospa<1 / prereq view missing / axis present / gap≠210 / own≠0 / conflict≠0 / emit≠0	self (DO-block)	—
1 Structure	10_structure.sql	Tier-0 pass	+11 tables, +31 views, +1 fn (all inert; 0 rows read)	db≠directus	re-query any view returns 0 rows; prod_verify/ui_read_contract.sql	99_rollback_full.sql (DROP set)
2 Responsibility axis	20_responsibility_axis.sql	Tier 1	+1 axis_registry, +6 axis_value, +1 coverage_rule	ospa<1 / required≠210 / generalized gap≠canonical	zero-drift assert: required=210, gap==v_object_owner_gap	per_tier_rollback (Tier 2 block)
3 Ownership seed (sovereign)	30_ownership_seed.sql	Tier 2 + :ratified_apr	governance_object_ownership 0→30; gap 210→0	ospa<1 / gap≠210 / own≠0 / conflict≠0 / new≠30 / post gap≠0	pre-commit assert new=30, gap=0, conflict=0	per_tier_rollback (Tier 3 block: DELETE by created_by)
4 Containment	40_containment.sql	Tier 3	+1 axis, +5 values, +1 rule, +35 assignment, +35 axis ownership; containment gap 0	ospa<1 / required≠35 / gap≠0	post assert required=35, gap=0	per_tier_rollback (Tier 4 block, tag PROD_containment_2026-06-03)
5 Topic finalization	50_topic_finalization.sql	Tier 4	+1 axis, +9 values, +7 taxonomy_map, guarded topic assignments, auto-derived decisions; divergent 0, projection_gap 0	ospa<1 / divergent≠0 / projection_gap≠0	post assert divergent=0, projection_gap=0	per_tier_rollback (Tier 5 block, tag PROD_topic_2026-06-03)
6 Scanner baseline + event boundary	60_scanner_baseline.sql	Tier 5	drift state materialized (~38 findings); event types stay inactive	ospa<1 / critical≠0 / emittable≠0 / outbox≠0	post assert critical=0, emittable=0, outbox=0	per_tier_rollback (Tier 6 block: TRUNCATE state)
8 Verification	90_verify.sql	Tiers 1–6	none (read-only)	any invariant off	full read + asserts (gap/conflict/containment/divergent/projection/critical/emittable/outbox all 0)	—

(Tier 7 "event/issue boundary, inactive" is folded into Tier 6: the boundary views ship in Tier 1 and the inactive-emit assertion is enforced in Tier 6 and Tier 8. Tier 9 rollback is prod_rollback/.)

Expected production end-state (= clone golden harness)

resp gap 0 · resp conflict 0 · containment required 35 / gap 0 · responsibility-axis required 210 / gap 0 · active axes 3 · divergent 0 · projection_gap 0 · label_orphans 0 · open drift ~38 (critical 0) · emittable 0 · gov outbox 0 · kg-domain-x active · reconcile decisions ~6. (topic gap may be >0 for legitimate quarantine holds — not asserted to 0.)

Mission-tier mapping

Mission Tier 0→T0; Tier 1 (base substrate)→T1+T2; Tier 2 (ownership seed)→T3; Tier 3 (axis/topic seed & promotion)→T4+T5; Tier 4 (scanner/candidate)→T6 (scan) [candidate findings are populated by scan]; Tier 5 (drift + UI views)→shipped in T1, exercised in T6/verify; Tier 6 (event/issue inactive)→T6 assertions; Tier 7 (verification)→T8; Tier 8 (rollback)→prod_rollback/.

Out-of-scope invariants (must be identical entry==exit)

gov event_outbox 0 · event types active 0 · approval_requests 211 · apr_approvals 42 · responsibility scopes 6 · idle_in_txn 0 · system_issues (organic only). Probe: prod_verify/baseline_probe.sql.