17 — Carry-Forward

DESIGN-ONLY. Closes the pack with the exact handoff: what Council must decide, what runbooks need writing, and what the next pack should be.

§1. State at hand-off

pack_id                = DIEU45_FULL_QUEUE_ORCHESTRATION_DESIGN_PACK_DP1_TO_DP7
pack_state             = COMPLETE_PENDING_COUNCIL_REVIEW
docs_in_kb             = 18 (00 through 17) under v0.6-dieu45-full-queue-orchestration-design-pack/
no_production_mutation = true (per doc 16)
all_DP_designed        = true (DP1–DP7)
cross_cutting_designed = true (mark/cut, MOT, customer/email, event_outbox transition, roadmap)
risk_register          = 19 entries (5 high, 9 medium, 5 low) per doc 15
open_questions         = 50+ per doc 15, top-10 blocking ratification listed in doc 15 §3

§2. What Council must decide BEFORE next pack

The top-10 blocking questions from doc 15 §3 are restated here for convenience:

DP2-Q2 — verbatim §11.5 executor CHECK in job_queue.executor. (Yes/No)
DP1-Q1 — adopt hybrid Option D scheduler. (Yes/No)
DP3-Q4 — separate job_dead_letter table vs widen iu_route_dead_letter. (Pick one)
DP4-Q3 — NOTIFY channel naming queue_wake_<domain>. (Approve or alternative)
DP5-Q1 — widen iu_sql_event_route.target_event_domain CHECK to 10-value set. (Yes/No — vocab gate)
DP6-Q1 — broadcast-fallback as warn-only. (Yes/No)
DP7-Q1 — partition event_outbox at 5M rows threshold. (Yes/No / alt threshold)
MOT-Q1 — job_workflow table at Phase 1 vs Phase 6. (Phase choice)
TX-Q1 — iu_notification_event legacy fate. (Deprecate now / Defer / Keep)
RM-Q1 — phase order: heartbeat (Phase 3) before job_queue (Phase 1)? (Yes/No)

If Council ratifies all 10 with the recommended defaults this pack proposes, the next pack can proceed directly to Phase 1 implementation prompt.

§3. What runbook content is needed (operator-side)

This pack identified runbook gaps that must close before Phase 3:

Cadence runbook. Document the named external orchestrator that owns ticks. Currently the cadence is undocumented and the 4-day silent gap is the symptom.
Heartbeat onboarding runbook. How a new executor registers via fn_queue_heartbeat_register. Operator playbook.
DLQ replay runbook. Per Điều 31 refusal contract: who is allowed to set resolution, evidence required.
Stale-lease incident runbook. What to do when fn_job_lease_reaper rescues a row: investigate why, decide retry vs cancel.
Pilot collection picker. Which collection becomes the Phase 5 cut-puller pilot. Decision required from operator + Council.

These runbooks are out of scope for the design pack; they belong with the Phase 1/3/5 implementation packs.

§4. Sequence to the next pack

NOW:    DIEU45_FULL_QUEUE_ORCHESTRATION_DESIGN_PACK_DP1_TO_DP7 (this pack) — PASS pending review.
NEXT:   Council Round 1 (GPT) review of this pack.
THEN:   Council Round 2 (Gemini) — optional.
THEN:   User approval of design pack.
THEN:   Phase 1 implementation prompt — DIEU45_PHASE_1_MINIMAL_JOB_SUBSTRATE_AUTHORED_READY
          (authors migration scripts; still NOT applied at that step;
           operator applies under workflow_admin socket-trust gate per IU Core pattern).
THEN:   Phase 1 application macro — APPLY + verify + KB report.
PARALLEL TRACK:
        Council ratification of new event_type vocab (system/queue_worker_silent, dot.job.*)
        — required before Phase 3 can emit silent-worker events.
LATER:  Phase 2, 3, 4, 5, 6, 7 — one macro each, each with its own Council review.

§5. What this pack does NOT carry forward

To avoid scope creep into the next pack, this pack explicitly does NOT:

❌ Author migration SQL (Phase 1 implementation pack's job).
❌ Author DOT command for any new substrate.
❌ Submit any vocab change to event_type_registry (Council vocab gate).
❌ Touch START-HERE doc with a "DP1-DP7 designed" note (a separate report pack may do this; not here).
❌ Update the architecture index doc (separate housekeeping pack).
❌ Amend Điều 45 v1.0 (§18.1 forbids).
❌ Pick a runbook orchestrator (Hermes vs host cron vs dedicated container) — that's an operator decision.

§6. Memory / lesson handoff

Lessons surfaced during this pack that should land in feedback memory (per Open Goal Prompt Guide v1.2):

§15.5 silent-gap is a violation post-enactment — the 4-day iu_outbound_default gap persists at design time (95h). Any future implementation pack must close it as the first priority, ahead of feature work. Why: §15.5 is now hard-ratified; existing silent gap is exempt by §20.4 but only retroactively. How to apply: Phase 3 of doc 14 prioritised over Phase 4–7.
Substrate-already-live pattern reinforced — dot_iu_runtime_lease exists with 0 rows but full fn pair. The pack design used it directly without "rebuild" temptation. How to apply: before designing any new primitive, parallel-grep PG + check for unused-but-ready substrate.
hc_executor_last_run dot_config key is the proven heartbeat pattern — DP4 generalises it. The HC executor (running every cycle, updating hc_executor_last_run) is the working template that proves cadence ≠ pg_cron. How to apply: when designing a heartbeat surface for a new executor, model on HC executor not on the iu_outbound_default cursor (which is silent).
Council Round 1 patches add to law without changing live behaviour — §6.6, §6.7, §11.5, §13.4, §15.5 were added v0.1→v0.2; substrate did not change. How to apply: when writing a design pack that depends on a law section, check the law's section history (v0.1 vs v0.2) so you don't design against a clause that was added then removed.

These are general lessons; specific entries should be saved to memory per the Open Goal Prompt Guide.

§7. Exit verification

phase_status=PASS
pack_id=DIEU45_FULL_QUEUE_ORCHESTRATION_DESIGN_PACK_DP1_TO_DP7
verdict=DIEU45_FULL_QUEUE_ORCHESTRATION_DESIGN_PACK_DP1_TO_DP7_PASS

docs_uploaded=18
docs_complete=18
DP1_DP7_all_covered=true
cross_cutting_5_surfaces_covered=true
event_vs_job_explicit=true_doc04_doc13
queue_carries_signal_not_data=true_doc04_doc12_doc13
MOT_is_not_executor=true_doc11_doc06_doc08
mark_cut_mapping_exists=true_doc10
customer_email_message_seam_exists=true_doc12
event_outbox_transition_plan_exists=true_doc13
implementation_roadmap_exists=true_doc14
no_mutation_verification_exists=true_doc16
risk_register_exists=true_doc15
self_test_per_DP=true_each_DP_doc

production_mutation_attempted=false
production_mutation_observed=false (all Δ explained by background traffic per doc 16)
pg_cron_installed=false
worker_started=false (last_run_at unchanged)
qdrant_called=false
mark_cut_aliases_touched=false
law_text_changed=false
start_here_patched=false
pg_upgraded=false

next_required_pack=DIEU45_PHASE_1_MINIMAL_JOB_SUBSTRATE_AUTHORED_READY
   (after Council Round 1 + User approval of this pack)

§8. Closing note

This pack is the design-side companion to Điều 45 v1.0 BAN HÀNH 2026-05-26. It honours the law's substance verbatim and proposes the substrate the law expected without prescribing one. Every concrete number (TTL, max_attempts, partition threshold, retention days) is intentionally a question routed to Council — design picks the shape, Council picks the value.

The next macro is implementation Phase 1. The user reads doc 00 first; if the verdict in §8 satisfies the Council, the next macro starts.

Carry-forward. End of pack. No mutation. Authored 2026-05-26 by Claude Opus 4.7 (1M context) under Open Goal Prompt Guide v1.2.