Next Phase Recommendation

State after Phase 2

Layer	Status
Queue substrate (Phase 1)	Live, gates inert
Heartbeat governance (Phase 2)	Armed; passive marker surfaces §15.5 silent gap
Lease governance (Phase 2)	Dry-run + double-gated apply reaper live
DLQ governance (Phase 2)	Triage + dry-run requeue live; no apply requeue
Workers	NOT started
Real heartbeat callers	NOT wired — iu_route_worker_cursor.last_run_at still frozen at 2026-05-22 11:31:41
Route pilot	NOT designed for live cut yet

Recommended next pack

DIEU45_PHASE_3_REAL_HEARTBEAT_CALLER_AND_ROUTE_PILOT_DRY_RUN

Effort: high (45–70 min). Mode: LIVE APPLY with bounded proof, like Phase 2.

Phase 3 scope (proposed)

1. Wire a real heartbeat caller for iu_outbound_default. Two options to evaluate during planning:
   • Option A (low-risk): Add an external operator/Hermes ping that calls fn_queue_heartbeat_tick('iu_outbound_default','PG_worker',…) on a bounded cadence. No changes to the legacy worker.
   • Option B (higher-fidelity): Modify fn_iu_route_worker_run (or its wrapper) to call fn_queue_heartbeat_tick per invocation. Requires touching the legacy route worker path.
   • Decision criterion: A is preferred unless Option B's incremental cost is small AND Option A's external dependency is unacceptable.
2. Route pilot dry-run for a single low-risk job_kind:
   • Pick one iu_sql_event_route consumer (TBD — likely iu_outbound_default's domain).
   • Build fn_route_consumer_dry_run that previews what would be enqueued into job_queue if substrate were on. SELECT-only.
   • No durable enqueue. No worker. No CHECK widening.
3. Open Question RM-Q1 closure: now that Phase 2 has delivered governance-before-pilot, the design pack's "invert Phase 3 ↔ Phase 1" question is moot.

Phase 3 deliberately DEFERRED

• queue.job_substrate.enabled=true durable flip (still inert at exit).
• queue.worker.enabled=true durable flip.
• pg_cron install.
• iu_sql_event_route CHECK widening (still domain=iu only).
• MOT/customer/email runtime.
• DLQ apply-side requeue.
• Lease reaper as job_kind.

Open questions still routed to Council

From the original design pack risk register, still open after Phase 2:

• DP1-Q3: Phase 3 schedule cadence — operator-driven vs minimal external daemon?
• DP3-Q5: Lease reaper as job_kind (Phase 3+ when substrate on).
• DP4-Q2: Heartbeat threshold tuning — start at 300s or per-executor override?
• DP6-Q1: DLQ requeue idempotency-key handling (re-use vs new key).
• DP7-Q4: When to start applying retention policy (DLQ 365d, job_queue 30d/90d).

Cross-links

• Parent enacted law: [[project-dieu45-v1-0-enacted-2026-05-26]]
• Phase 1: [[project-dieu45-phase1-minimal-job-substrate-live-apply-pass-2026-05-26]]
• Design pack DP3 (lease) and DP4 (heartbeat): [[project-dieu45-full-queue-orchestration-design-pack-dp1-to-dp7-pass-2026-05-26]]
• Silent-gap closure rationale: [[feedback-dieu45-silent-gap-violation-post-enactment]]
• HC heartbeat pattern: [[feedback-hc-executor-last-run-is-proven-heartbeat-pattern]]