Sub-ticket of VENUS-121 fix(db): venus fn_appevents_immutable §5.1 bug — bypass path does unconditional RETURN OLD, silently no-ops any bypass-gated UPDATE (harmless today: both retention cron jobs DELETE-only; bites future bypass UPDATEs, e.g. category retags — solo's Stage-D retag needed the drop-dance to sidestep it). Fix = RETURN NEW on UPDATE / RETURN OLD only on DELETE, per the fleet-ratified SSOT amendment. Land when the SSOT doc fix lands (bin-whey-gated). · venus