IU Core Event Worker — 04 Worker dry-run proof + durable apply

Probe — 8 scenarios, one BEGIN...ROLLBACK txn, 0 durable rows

The full package (008+009+060, BEGIN/COMMIT-stripped) was created inside one transaction against the live production schema, exercised, and rolled back.

Probe	Scenario	Result
SETUP	open worker gate	master t, worker t
A	emit 3 synthetic iu events via fn_iu_emit_event	event_outbox iu rows = 3
B	fn_iu_route_worker_run dry-run pass	seen=3, attempts_written=3, skipped=0, dead_lettered=0; 3 iu_route_attempt rows outbound/dry_run/iu.version_applied.workflow; cursor advanced
C	re-run (cursor idempotency)	seen=0; attempts still 3
D	reset cursor, re-run (key idempotency)	seen=3 but table still 3 — ON CONFLICT suppressed the re-write
E	dead-letter + fail-closed delivery (dry_run=false)	dead_lettered=3; 3 failed attempts; failure_code=worker_process_error; seam_failclosed=t; v_iu_route_dead_letter_open = 3
F	fn_iu_route_dead_letter_replay	status=replayed, decision=dry_run, resolved=true, attempt_no=2; dlq resolved=1 / open=2
G	healthcheck + 3 observability views	health.healthy=true; v_iu_route_attempt_summary = dry_run 4 / failed 3; backlog 0
H	gate fail-closed	worker gate off → worker_gate_closed; master gate off → master_gate_closed

Probe E drops iu_outbound_route_safe_chk inside the txn only to make an enabled+dry_run=false route possible — this exercised the worker's delivery branch and proved it fails closed (the seam RAISES, the event is dead-lettered, nothing is delivered).

Zero-durable-footprint post-check

After the probe rolled back: worker tables 0, worker functions 0, event_outbox iu 0, iu_route_attempt 0, worker config key 0, master gate true, outbound route true/true — clean.

Durable apply

After the probe proved the package, with backup taken (doc 02) and all 8 gates PASS:

1. Applied 008 + 009 + 060 to production directus (psql -v ON_ERROR_STOP=1), no error.
2. runtime/070 verification — all 9 checks PASS:
   • W1 — 2 substrate tables present.
   • W2 — 5 worker functions present.
   • W3 — 3 observability views present.
   • W4 — worker gate false (seeded INERT).
   • W5 — iu_outbound_default cursor registered, fresh (NULL keyset).
   • W6 — delivery seam fails closed.
   • W7 — worker checks both gates.
   • W8 — healthcheck healthy=true, worker_gate_open=false.
   • W9 — backlog view returns 0.

Durable end-state

Worker installed inert on production: worker gate false, cursor fresh, 0 attempts, 0 dead-letters. information_unit 158 / unit_version 165 / iu_tree_path 158 — unchanged. The durable apply added exactly 2 empty tables (+1 seed cursor row), 5 functions, 3 views, 1 config key (false). No route enabled, no lifecycle mutation, no delivery, no IU/UV change.