IU Core Controlled Route + Master Gate — 11 Final report

Macro: IU_CORE_CONTROLLED_ROUTE_MASTERGATE_STRUCTURE_OBSERVABILITY_OPEN_GOAL Date: 2026-05-21 · Outcome: IU_CORE_CONTROLLED_DRYRUN_RUNTIME_PASS

1. Final status — PASS

IU Core moved from "runtime installed but inert" to controlled dry-run live runtime with a working evidence loop. All pass criteria met; no forbidden action taken.

2. What changed

• Production directus (durable): 006 (H4 reconcile), 007 (version_seq reconcile), outbound route iu.version_applied.workflow → enabled=true, dry_run=true, master gate dot_config 'iu_core.routes_master_enabled'='true', runtime/050 → 158 iu_tree_path rows.
• Repo: 005 patched in-place (version_seq filter); new 007 + rollback; new runtime/050 + rollback; runtime/040 V7 check; README; tests.

3. Repo

Branch main; HEAD 5de52d8 → 0ad425a (parent 5de52d8). Commit 0ad425a feat(iu-core): version_seq filter (007) + structure tree bootstrap (050) — 8 files, +319/-5. Tree clean. No push/merge/tag.

4. Production backup

/root/backups/iu-core-runtime/directus-pre-iucore-controlled-route-20260521T132841Z.dump · 74,646,603 B · sha256 7fa853152f83372e6d57f5af7d6aa16bd35720961e21083b72572926b97ee380 · 2983 TOC entries, verified restorable.

5. H4 / 006 result

006 applied. iu_structure_operation_enacted_chk is now (enacted_at IS NOT NULL) = (operation_status IN ('enacted','rolled_back')). H4 closed on production.

6. Route / master-gate dry-run result

Outbound route enabled=true, dry_run=true; master gate open (fn_iu_core_routes_enabled()=true). Inbound route kept enabled=false, dry_run=true. runtime/040 V1–V7 all PASS. No dry_run=false.

7. version_seq ruling / evidence

Ruled: align the bus to version_seq > 1 (mirrors iu_notification_event). 007 applied — fn_iu_outbound_on_version md5 0949b28b… → ff5feef8…. Evidence: Probe A (seq=2 emits), Probe B (filter deployed), 040 V7. Resolved, not deferred.

8. Event evidence loop

6 probes, all BEGIN…ROLLBACK, 0 durable rows: outbound event_outbox emit (A), version_seq filter (B), inbound iu_route_attempt dry-run (C), disabled-route fail-closed (C2), gate-close kill (D), route-disable + trigger-detach (E). All PASS. See doc 05.

9. Consumer readiness

event_outbox is an unconsumed append-only log — no delivery-state columns, no worker container, no cron, not a Directus collection, no flow consumer. Opening the gate enqueues events that accumulate undelivered → no downstream delivery. dry_run=false needs a route worker built first (doc 06 / 10).

10. Structure tree / lineage

runtime/050 applied — 158 iu_tree_path rows bootstrapped from v_iu_tree (all depth 0; flat tree). Additive, idempotent, rollback-guarded. iu_relation / iu_structure_operation legitimately empty (no structure-ops history). See doc 07.

11. Disable / rollback proof

3-layer disable runbook proven (Probes D + E): close master gate (instant) → disable routes → detach triggers. Reversible. See doc 04.

12. Tests

542 → 553 (+11: TestOutboundVersionSeqFilter +6, TestStructureTreeBootstrap +5). 553 passed.

13. KB reports

9 docs in …/v0.6-iu-core-controlled-route-mastergate-structure-observability-open-goal/ (01 precheck, 02 backup+drift, 03 migrations, 04 activation+disable, 05 evidence, 06 consumer+version_seq, 07 structure tree, 10 next macro, 11 final).

14. Exact next macro

Build the event_outbox route worker (doc 10) — the prerequisite for any future dry_run=false. Alternative: structure-ops production enablement.

Forbidden actions — none taken

No dry_run=false, no downstream delivery, no external worker activation, no lifecycle mutation of existing IUs, no destructive cleanup, no deploy/restart, no execution_enabled flip, no secret logged, no push/merge/tag.