04 — Worker Dry-run Evidence, Auto-cut Bridge Proof, Rollback Readiness

Worker dry-run evidence — REAL IU-domain events (runtime/150)

The previous macro's worker run saw seen=0 — no organic IU event existed. After runtime/170 emitted 18 structure_op_applied events, runtime/150 (the disabled-by-default invocation package: healthcheck -> bounded run -> healthcheck) was invoked:

Stage	Result
I1 pre-health	healthy=true, backlog_iu_events=18, gates open, dead_letter_open=0
I2 run	status=ran seen=18 attempts_written=18 skipped=0 dead_lettered=0
I3 post-health	healthy=true, backlog 0, events_seen_total=18, attempts_written_total=18, dead_lettered_total=0
I4 audit	route_attempts=18 dead_letters=0

Route-attempt decision breakdown (iu_route_attempt): route_code=iu.structure_op_applied.workflow, status=dry_run, n=18, none_delivered=true. Every attempt is a logged dry-run DECISION; zero downstream delivery. This is the first genuine IU-domain dry-run worker evidence — the worker-evidence gap is closed.

Auto-cut bridge — DB-backed proof (sandbox/060)

sandbox/060_autocut_bridge_probe.sql upgrades the auto-cut bridge from "executable over InMemoryStructureStore" to "drives the live SQL substrate". A synthetic CutResult (no production CUT executed) is mapped — per autocut_bridge.CUT_OPERATIONS — to structure-op requests driven through fn_iu_structure_op_plan/_apply/_verify. One BEGIN ... ROLLBACK, zero durable rows.

Check	Result
C0	inputs discovered: D38-DIEU28-S1-P1 / D38-DIEU28-S1 / D38-DIEU28-ROOT
C1	3 planned envelopes recorded: add_new_piece, split_large_piece, reparent_piece
C2a	reparent apply ok=true, event_emitted=true
C2b	reparent verify ok=true (tree_path_ok/relation_ok/tree_acyclic)
C2c	evt_before=0 -> evt_after=1 — one structure_op_applied event emitted
C3	add_new_piece / split_large_piece apply RAISE feature_not_supported — ok=2 unexpected=0 (honest MVP boundary)
C4	re-plan with the same new id -> same operation id (idempotent)

This proves the cutter lifecycle output maps to IU Core structure AND event records on the real DB: plan for all types, apply/verify for reparent, honest feature_not_supported for the not-yet-built add/split.

Rollback / compensation readiness — proven

• Per-op: fn_iu_structure_op_rollback is the gated compensation; each runtime/170 op snapshots its prior_parent / relation_written / relation_retired into iu_structure_operation.impact_summary — rollback needs no external input.
• Batch: runtime/rollback/170_structure_op_batch_tree_build.rollback.sql rolls back every op by actor iu_core_runtime_170 (reverse canonical order).
• Proven non-durably: a BEGIN ... ROLLBACK probe of the batch-rollback logic rolled back all 18 ops (rolled_back=18 failed=0), restored the tree (iu_tree_path 158 = v_iu_tree 158, nested back to 1), then discarded the transaction — production stayed at 19 nested.

Worker invocation / scheduling package

runtime/150_route_worker_invocation.sql is the disabled-by-default invocation package — healthcheck -> bounded run -> healthcheck, idempotent, no daemon, no cron installed. The cron line is provided commented; the worker gate iu_core.route_worker_enabled is the single arm/disarm point. No persistent service was started, no cron activated.