05 — Events / worker / idempotency / DOT / no-hardcode / five-layer

1. Composer events — the durable run + the operator mutation

Composer event_outbox rows for collection 16ba77a5…, all on the 'delayed' lane, every id distinct:

event_type	count	source
collection_created	1	runtime/290 fn_iu_compose
piece_added_to_collection	3	runtime/290 fn_iu_compose
collection_rendered	2	runtime/290 checkpoint + the OperatorRuntime dot_iu_checkpoint_collection apply
piece_reordered	2	the OperatorRuntime dot_iu_reorder_piece applies (step 2 + step 5)
total	8	8 distinct ids

This satisfies the requirement that composer events be emitted by both the durable integrated run AND the operator-runtime mutation — piece _reordered ×2 and one collection_rendered come from the OperatorRuntime apply path.

2. Idempotency / no dedupe regression

8 events, 8 distinct ids, all delivery_lane='delayed'. The 500x delayed-lane fix holds: the event_outbox partial unique index idx_event_outbox_idempotent is WHERE delivery_lane='immediate', so the composer family on 'delayed' is never deduped — all 3 piece_added and both piece_reordered rows land distinct. No dedupe regression.

3. Worker dry-run — no external delivery

One durable route-worker run after the durable mutations: fn_iu_route_worker_run('iu_outbound_default', 200) → seen=8, attempts_written=8, skipped=0, dead_lettered=0. The 8 new composer events were all dry-run-delivered. iu_route_attempt 60 → 68 (67 dry_run + 1 historical sent); iu_route_dead_letter open 0. Every composer route is dry_run=true — external delivery is structurally impossible.

4. DOT — unchanged at 113/113

runtime/110 after the macro: 113/113 (table 16 / view 16 / function 40 / trigger 3 / config 7 / event_type 15 / route 16), every D9 class ok=true, D8 drift 0. The macro adds DATA rows (IUs / collection / memberships / events / ledger / route attempts) — no new production-visible object — so the DOT inventory is unchanged. runtime/290 is CREATE-free by construction.

5. No-hardcode — PASS

• runtime/290 / runtime/rollback/290 — 0 password / DSN / IP / :5432 literal; the 3 canonical addresses are gen_random_uuid()-suffixed; the composer vocabulary (design_doc_section/section/file) is classified.
• operator_runtime_durable_proof.py / text_as_code_roundtrip_proof.py — 0 secret/DSN literal; deployment coordinates are argv; the collection + the reordered piece are resolved by live discovery, never baked in.
• The OperatorRuntime ledger stores an md5 params_digest — no raw value logged.

6. Five-layer sync

Layer	Impact
PG	Real, durable: runtime/290 (+3 IU / +1 collection / +3 membership / +5 composer events), the OperatorRuntime proof (+7 ledger rows, +3 composer events from the apply path), one worker dry-run (+8 iu_route_attempt). All additive / reversible.
Directus	None — IU Core objects are sidecar tables, not Directus collections. No Directus-managed data touched.
Nuxt	Render-only — v_dot_iu_command_registry / v_iu_collection_manifest remain read surfaces; no component contract change.
AgentData / KB	This macro's 7 reports + 2 proof drivers uploaded + list/read/search-verified. The prior macro's 7 reports had their 500x/540x title+tag mismatch repaired (revision 1→2, content preserved).
Qdrant / vector	No write. The new iu-tree/_collections/file/iu_core.autocut.file-001.md manifest is a natural deterministic vector-index unit (carried forward).

7. Observability

Surface	Source
operator command registry + run aggregates	v_dot_iu_command_registry
operator-runtime run health	v_dot_iu_command_run_health (11 runs / 6 apply / 4 applied / 2 refused / 0 failed)
collection health / manifest	v_iu_collection_health / v_iu_collection_manifest
composer event backlog	v_iu_composer_event_backlog
route attempt summary / dead-letter	v_iu_route_attempt_summary / v_iu_route_dead_letter_open
DOT conformance	runtime/110 — 113/113

8. Rollback / disable readiness

• runtime/290 → runtime/rollback/290 (soft-delete 3 minted IUs, drop collection + memberships).
• The OperatorRuntime reorder is self-compensating — the inverse one-command was already run durably (step 5); the 7 proof ledger rows are reversible by DELETE … WHERE actor='runtime_500x_op_proof'.
• Disable path: close operator_runtime_enabled (apply refuses) / close composer_enabled (every composer mutator refuses) / close routes_master_enabled (emission stops) / close route_worker_enabled.
• End-state: every IU Core gate inert except the controlled master gate + dry-run worker. No execution_enabled flip. No external delivery.