02 — Structure-op Event Emission Layer (migration 011 + runtime/160)

Closes open gap #1 of the first-durable-structure-op macro: structure ops now emit an IU-domain event, so the route worker has organic evidence to consume.

Migration 011 — sql/iu-core/011_structure_op_event_emission.sql

CREATE OR REPLACE FUNCTION public.fn_iu_structure_op_apply(uuid) — the migration-010 body, byte-for-byte, with ONE addition: after the planned -> enacted transition it PERFORMs fn_iu_emit_event:

fn_iu_emit_event('structure_op_applied', <child canonical_address>,
                 <child unit id>, <op actor_ref>,
                 { operation_id, operation_type, prior_parent, new_parent })

• Additive only — CREATE OR REPLACE FUNCTION; no table/trigger/data.
• Fail-closed — fn_iu_emit_event returns NULL (no outbox row) when the master gate is closed OR structure_op_applied is not registered/active in event_type_registry. A structure op never fails because the bus is closed.
• Metadata-only — the safe payload carries no body/content/raw/secret/token keys; event_outbox.safe_payload CHECK enforces this.
• No downstream delivery — fn_iu_emit_event only appends an event_outbox row.
• The apply result JSON gains event_emitted (boolean).

Rollback: sql/iu-core/rollback/011_structure_op_event_emission.rollback.sql restores the exact migration-010 body (no emit call site).

Runtime 160 — sql/iu-core/runtime/160_structure_event_register.sql

Makes the event deliverable + DOT-visible. Idempotent.

Object	Registration
event type	event_type_registry row ('iu','structure_op_applied','update','immediate','info',...,active=true)
outbound route	iu_outbound_route row iu.structure_op_applied.workflow — event_domain=iu, event_type=structure_op_applied, event_stream=update, target_kind=workflow, enabled=true, dry_run=true, fail_closed=true

• Dry-run-safe by construction — the route is enabled=true, dry_run=true. The CHECK iu_outbound_route_safe_chk (enabled=false OR dry_run=true) makes an enabled+dry_run=false route impossible to seed. enabled=true makes the worker log a real dry_run delivery DECISION (not disabled/skipped); dry_run=true means it delivers nothing — fn_iu_route_deliver is unreached.
• event_stream='update' — one of the 7 event_outbox-permitted streams; a structure operation updates the IU tree. event_stream/delivery_lane are sourced into fn_iu_emit_event from this registry row, never hardcoded.

Rollback: runtime/rollback/160_structure_event_register.rollback.sql disables the route (enabled=false) and deactivates the event type (active=false).

Install evidence (production)

• 011 applied — BEGIN / CREATE FUNCTION / COMMENT / COMMIT.
• 160 applied — R1 event type active=t (update/immediate); R2 route enabled=t dry_run=t fail_closed=t.
• Proven by sandbox/060 before the durable batch: a reparent apply reported event_emitted: true and exactly one structure_op_applied event was written to event_outbox (inside the aborted txn).