05 — DOT, No-hardcode, Five-layer, Finding H5

DOT conformance — 41 -> 43

runtime/110_iu_core_dot_conformance_scan.sql updated: the SSOT inventory _iu_core_expect gains ('event_type','iu.structure_op_applied') and ('route','iu.structure_op_applied.workflow'); the D9 verdict VALUES bump event_type 1->2, route 2->3.

Live scan after all changes (production):

class	expected	found	ok
table	9	9	t
view	6	6	t
function	18	18	t
trigger	2	2	t
config	3	3	t
event_type	2	2	t
route	3	3	t

D9 43/43 PASS, every class ok=true. D8 drift guard: 0 unregistered objects. Every new production-visible object is DOT-covered.

No-hardcode — PASS

• Migration 011 references config keys, schema identifiers, and the event vocabulary identifier structure_op_applied only (the same pattern as fn_iu_outbound_on_version emitting version_applied). event_stream / delivery_lane are resolved FROM event_type_registry inside fn_iu_emit_event, never at the emit site.
• runtime/170 bakes no document code and no IU id — the target document and every reparent pair are discovered by canonical_address query. Test test_170_has_no_hardcoded_doc_or_id asserts no DIEU-* literal and no uuid.
• Scan of all new files for IP / DSN / secret / api-key / private-key: 0 matches (the only secret hits are comment text naming the forbidden safe_payload keys).

Five-layer sync

Layer	Impact
PG	Real change — fn_iu_structure_op_apply replaced (emit added); 1 new event type + 1 new route row; 18 durable reparent_piece ops; +18 iu_structure_operation, +18 iu_relation, 18 information_unit adjacency pointers set, iu_tree_path recomputed; +18 event_outbox rows; +18 iu_route_attempt rows.
Directus	18 information_unit rows get parent_or_container_ref set — a data change to an existing collection; no schema/collection change. event_type_registry / iu_outbound_route are not directus collections.
Nuxt	No code change. Any IU-tree render now shows the DIEU-35 hierarchy (19 nested IUs, depth 0/1/2).
AgentData/KB	This macro's reports added; the previous macro's 5 reports repaired (uploaded).
Qdrant/vector	No impact — a reparent / structure event changes tree structure and emits metadata, not IU content or embeddings.

Finding H5 — runtime/130 S8 stale semantics (FIXED)

runtime/130 S8 counted operation_status='enacted' and its footer declared "PASS when S8 enacted_open = 0". That only holds on a greenfield DB: enacted is a terminal resting state for a successfully applied durable op (per structure_ops.py OPERATION_STATUS_TRANSITIONS, enacted is terminal unless rolled back). After any durable structure op, S8 would be > 0 and the file would read as a false failure.

Fix: S8 now counts genuinely stranded mid-flight ops (operation_status IN ('draft','planned')) and reports enacted_terminal / rolled_back_terminal informationally. Footer: "PASS when ... S8 stranded_midflight = 0". Live result: stranded_midflight=0, enacted_terminal=19, rolled_back_terminal=0. Repo-only fix (runtime/130 is a read-only verification script); re-run on production confirmed.