IU Core Event Worker — 08 dry_run=false approval package

The exact gates, proof, and rollback for the future macro that enables live delivery. None of this is approved or done in the current macro.

Blockers that must clear first

1. The delivery seam is unbuilt. fn_iu_route_deliver RAISES feature_not_supported. A real downstream target must be designed and built — the outbound route iu.version_applied.workflow declares target_kind='workflow', target_ref='event_outbox'; the macro must decide what "delivery" concretely means (a Directus flow, a workflow engine, a notification fan-out) and implement the seam.
2. The route safety CHECK forbids it. iu_outbound_route_safe_chk (enabled=false OR dry_run=true) makes an enabled+dry_run=false route impossible. The macro must relax/replace this CHECK as an explicit, backed-up DDL step.
3. No organic consumer evidence yet. event_outbox has 0 iu-domain rows. Doc 10 of the controlled-route macro requires observing real outbound iu_route_attempt dry_run rows from organic version_seq>1 unit_version inserts before dry_run=false.
4. Cursor safety-lag. The monotonic keyset cursor can skip a row committed late with an earlier created_at. A delivery worker needs a high-water-mark / lag window (doc 03 limitation).
5. Invocation mechanism. No daemon was built (forbidden). The macro must choose how the worker runs (cron job / DOT phase) — and that scheduler is a persistent component needing its own approval.

Mandatory gates for the dry_run=false macro

• Fresh pg_dump -Fc backup.
• Worker substrate (008/009/060) already on production — done this macro.
• Worker gate opened (iu_core.route_worker_enabled='true'), worker run in dry-run, and organic iu_route_attempt dry_run rows observed.
• Delivery seam built + unit-tested + probed BEGIN…ROLLBACK.
• iu_outbound_route_safe_chk relaxed under backup.
• Disable path proven: worker gate → false, route dry_run → true.

Consumer proof required

A BEGIN…ROLLBACK probe showing: the worker resolves a real route, calls the built seam, the seam delivers to the chosen target, iu_route_attempt status sent, delivered=true, no dead-letter, and a re-run is idempotent (same key, ON CONFLICT no-op).

Rollback / disable

• Worker gate false (runtime/080) — instant stop.
• Route dry_run=true — back to log-only.
• Re-add iu_outbound_route_safe_chk.
• rollback/009 + 008 if the substrate must go (REFUSED while history exists).

Expected evidence at PASS

Organic dry-run attempts → built seam → one controlled dry_run=false delivery with the real target → iu_route_attempt status='sent' → dead-letter empty → idempotent re-run → disable proven.