IU Core Event Worker — 09 Final report

Macro: IU_CORE_EVENT_WORKER_STRUCTURE_OPS_AUTOCUT_INTEGRATION_OPEN_GOAL Date: 2026-05-21 · Outcome: IU_CORE_EVENT_WORKER_DRYRUN_READY_PASS

1. Final status — PASS

IU Core moved from "event_outbox accumulates, no consumer" to a route worker installed on production with audit, observability, recovery and a healthcheck — inert and dry-run-safe, proven end-to-end. No forbidden action taken.

2. What changed

• Production directus (durable): migrations 008 (worker substrate) + 009 (worker functions + 3 views) applied; runtime 060 registered the worker INERT — dot_config 'iu_core.route_worker_enabled'='false' + iu_route_worker_cursor row iu_outbound_default. No route enabled, no delivery, no IU/UV/tree change.
• Repo: new 008/009 + rollbacks; runtime 060/070/080 + rollback 060; cutter_agent/iu_core/route_worker.py; tests; READMEs.

3. Repo

Branch main; HEAD 0ad425a → 4e86c64 (parent 0ad425a). Commit 4e86c64 feat(iu-core): event_outbox route worker — substrate + functions + dry-run-safe activation — 13 files, +1257/-8. Tree clean. No push/merge/tag.

4. Production backup / gate

/root/backups/iu-core-runtime/directus-pre-iucore-event-worker-20260521T141243Z.dump · 74,669,011 B · sha256 4d0b1f60362cfedb35e0fe18a7d245e9b1c1da6ea37e78013b22e8cb9356f99e · 1215 TABLE/FUNCTION/VIEW TOC entries, verified restorable. All 8 mandatory gates PASS (doc 01).

5. Worker architecture

SQL function worker (no daemon). 008 — iu_route_worker_cursor (keyset offset, since event_outbox has no delivery-state columns) + iu_route_dead_letter (recovery queue). 009 — fn_iu_route_worker_run (claim FOR UPDATE SKIP LOCKED → route → audit → cursor advance, all one txn), dual fail-closed gate, unbuilt fn_iu_route_deliver seam, fn_iu_route_dead_letter_replay, fn_iu_route_worker_health, 3 views. route_worker.py mirrors the decision contract. See doc 03.

6. Worker dry-run proof

8-scenario BEGIN…ROLLBACK probe against the live production schema, 0 durable rows: dry-run pass (3 events → 3 dry_run attempts), cursor idempotency, key idempotency (ON CONFLICT), dead-letter, fail-closed delivery (seam RAISES → dead-lettered, nothing delivered), replay, healthcheck, both gates. Post-check: clean. Then durable apply + runtime/070 W1–W9 all PASS. See doc 04.

7. Cursor / retry / dead-letter / audit

• Cursor — iu_route_worker_cursor, keyset (created_at,id), advanced atomically with attempt writes.
• Idempotency — deterministic key + UNIQUE (idempotency_key,attempt_no): no duplicate delivery decision. Proven (probes C, D).
• Dead-letter — iu_route_dead_letter snapshots failed events; never lost. Proven (probe E).
• Retry — fn_iu_route_dead_letter_replay re-attempts with incremented attempt_no. Proven (probe F).
• Audit — every event → exactly one iu_route_attempt row.

8. Observability / healthcheck

3 views (v_iu_route_attempt_summary, v_iu_event_backlog, v_iu_route_dead_letter_open), fn_iu_route_worker_health, read-only runtime/070. Disable runbook: L0 worker gate (runtime/080) → L1 master gate → L2 routes → L3 triggers. See doc 05.

9. Structure-ops workflow package

Design package (doc 06): plan→apply→verify→rollback envelope per operation type over the existing iu_structure_operation/iu_relation/iu_tree_path substrate; dry-run = planned, apply = enacted. Not built (mission scope: "prepare").

10. Auto-cut integration package

Design package (doc 07): version events are already integrated (trg_iu_out_version → event_outbox → the worker built this macro). IU creation / split / merge / iu_sql_link need a gated post-lifecycle_enact bridge phase. Not built — would be dead code before the structure-ops workflow exists.

11. dry_run=false readiness

Approval package (doc 08). Blockers: the delivery seam is unbuilt; the route iu_outbound_route_safe_chk forbids enabled+dry_run=false; no organic consumer evidence; cursor needs a safety-lag; an invocation mechanism must be chosen. The substrate prerequisite (worker built + verified) is done.

12. Tests

586 passed (was 553; +33 — TestRouteWorkerSubstrate +14, TestRouteWorkerRuntime +6, TestRouteWorkerHelpers +13).

13. KB reports

9 docs in …/v0.6-iu-core-event-worker-structure-ops-autocut-integration-open-goal/ (01 precheck, 02 backup+drift, 03 architecture, 04 dry-run proof, 05 observability, 06 structure-ops, 07 auto-cut, 08 dry_run=false, 09 final).

14. Exact next macro

Open the worker gate + observe organic dry-run attempts — flip iu_core.route_worker_enabled to true, invoke fn_iu_route_worker_run on a schedule, and collect organic iu_route_attempt dry_run rows from real version_seq>1 unit_version inserts (doc 08 gate 3). Alternative: the structure-ops production workflow (doc 06). Both are prerequisites for the dry_run=false macro (doc 08).

Forbidden actions — none taken

No dry_run=false; no downstream delivery; no persistent worker/daemon; no deploy/restart; no lifecycle mutation of existing IUs; no production CUT; no production VERIFY beyond read-only/post-change; no execution_enabled flip; no destructive cleanup; no secret logged; no push/merge/tag.