18000x · 07 — Piece Event Runtime Internal LIVE Proof

Goal

Prove fn_iu_piece_emit_event can produce a non-dry-run "live"-tagged row, inside a bounded BEGIN/ROLLBACK, without external delivery.

What changed at 18000x vs 15000x

• 15000x ran the proof with dry_run_only=true — emit produced an event_outbox row tagged safe_payload.emit_mode='dry_run'.
• 18000x flips BOTH gates inside the TX:
  • piece_event_runtime.emit_enabled : false → true
  • piece_event_runtime.dry_run_only : true → false
• Resulting row is tagged safe_payload.emit_mode='live'.

Live transcript

-- pre-state
piece_event_runtime.dry_run_only = true
piece_event_runtime.emit_enabled = false
event_outbox WHERE event_domain='piece' rowcount = 0

-- flip gates (inside TX)
UPDATE 1   -- emit_enabled=true
UPDATE 1   -- dry_run_only=false

-- emit
fn_iu_piece_emit_event(
    'updated',
    'iu_core/template/15000x/wf-onboarding-v1/step-0-d0-account',
    'ad22a9b5-…'::uuid,
    'iu-core-18000x',
    jsonb_build_object(
        'macro','18000x',
        'phase','E_internal_live_proof',
        'note','Bounded BEGIN/ROLLBACK live proof — internal only, no external delivery.'))
=> 660488da-d0e7-4caf-b7ec-987b137b6b2a

-- read-back
id                                   | event_type | event_subject_ref           | emit_mode | macro
660488da-d0e7-4caf-b7ec-987b137b6b2a | updated    | ad22a9b5-…                  | live      | 18000x

-- ceiling check
piece_route_count = 7  (routes EXIST in iu_outbound_route but no external worker)

ROLLBACK

-- post-rollback
piece_event_runtime.dry_run_only = true
piece_event_runtime.emit_enabled = false
event_outbox WHERE event_domain='piece' rowcount = 0   (unchanged)

Why this is safe

• The TX rolled back — no event_outbox row persists, no gate state persists.
• Even if the row had persisted, the iu_core.route_worker_enabled=true gate means the worker consumes the outbox, but the constitution authorises no external delivery in 18000x; the worker's fn_iu_route_deliver is governed by the iu_core.delivery_enabled and iu_core.delivery_live_routes gates, both of which are inert (false / empty).
• The 7 piece-domain routes in iu_outbound_route are routing surface only — they declare WHERE an event would go if delivery were enabled, not that delivery is enabled.

Exact ceiling for live (non-rollback) emit

To move from "bounded LIVE proof" to "durable LIVE emit":

1. Enable piece_event_runtime.emit_enabled=true durably (currently default false).
2. Decide policy on dry_run_only: keep true for durable-but-dry, or flip to false for durable-live tagging.
3. Configure external delivery in iu_core.delivery_live_routes (currently empty) — must list the specific route_codes allowed for delivery, and only AFTER an external worker contract is reviewed.
4. Set iu_core.delivery_enabled=true once routes are reviewed.

The constitution forbids steps 3–4 within this macro. Step 1+2 are technically a durable change but yield no observable behavior change (worker still won't deliver without 3+4); deferred to ≥19000x to keep the gate state matrix legible.

Comparison to 15000x

Property	15000x	18000x
emit_enabled during proof	true (in-TX)	true (in-TX)
dry_run_only during proof	true (default)	false (in-TX)
emit_mode tag in payload	dry_run	live
event_outbox row produced	1 (rolled back)	1 (rolled back)
Post-rollback gates	default	default
Post-rollback event_outbox piece	0	0