IU Core Worker Live — 02 Worker live dry-run evidence

Durable change — runtime/090 (committed to production)

sql/iu-core/runtime/090_route_worker_enable.sql — one transaction:

• dot_config 'iu_core.route_worker_enabled' → 'true' (worker gate OPEN).
• One fn_iu_route_worker_run('iu_outbound_default', 100): {"status":"ran","seen":0,"attempts_written":0,"dead_lettered":0, "cursor_event_id":null,"cursor_created_at":null} — clean, 0 organic events.
• Post-run audit: iu_route_attempt=0, iu_route_dead_letter=0.

The worker is invocation-based (no daemon, no cron). Opening the gate arms nothing on its own; 090 invoked it exactly once. Reversal: rollback/090 (= runtime/080) sets the gate false.

Read-only verification — runtime/100 (L1–L9 PASS)

sql/iu-core/runtime/100_route_worker_live_verification.sql (BEGIN…ROLLBACK): L1 worker gate true · L2 master gate true · L3 route enabled+dry_run · L4 route safety CHECK present (dry_run=false impossible) · L5 seam fails closed · L6 cursor first-run recorded, keyset still NULL · L7 audit 0/0 · L8 healthcheck healthy=true, worker_gate_open=true, backlog 0 · L9 backlog 0.

Functional proof — sandbox/040 BEGIN…ROLLBACK probe (9 scenarios PASS)

sql/iu-core/sandbox/040_worker_live_dryrun_probe.sql — synthesises one iu version_applied event through the production governed emitter fn_iu_emit_event (not a raw event_outbox INSERT), exercises the worker, and ROLLs the whole transaction BACK.

Probe	Result
P0 baseline	iu_events 0 / attempts 0 / dead_letters 0
P1 worker-gate-closed	worker_gate_closed — clean no-op
P2 dry-run pass	emit 1 event → seen=1, attempts_written=1; attempt status=dry_run, decision=dry_run, delivered=false
P3 cursor idempotency	re-run seen=0; attempts still 1
P4 key idempotency	reset cursor, re-claim seen=1; attempts still 1 (ON CONFLICT dedup)
P5 healthcheck	worker_gate_open=true, master_gate_open=true, attempts_in_audit=1, dead_letter_open=0, healthy=true
P6 fail-closed delivery	drop route CHECK in-txn, dry_run=false, fresh worker → dead_lettered=1, failed_attempts=1, delivered_sent=0, failure_code=worker_process_error
P7 dead-letter replay	replay while dry_run=false → decision=failed, resolved=false, attempt_no=2; restore dry_run=true, replay → decision=dry_run, resolved=true, attempt_no=3
P8 master-gate-closed	master_gate_closed — clean no-op
P9 in-txn	iu_events 1 / attempts 4 / dead_letters 1
POST-ROLLBACK	0 / 0 / 0; master gate true, worker gate true

Cursor / audit / dead-letter / healthcheck — verified

• Cursor — iu_outbound_default advances atomically with attempt writes (probe P2); a second run sees nothing (P3). Durable keyset still NULL (no organic events).
• Audit — exactly one iu_route_attempt per event; dry_run decision records delivered=false (P2).
• Idempotency — deterministic key + UNIQUE(idempotency_key,attempt_no): re-claim writes no duplicate (P4).
• Dead-letter — the unbuilt seam RAISES → event snapshotted into iu_route_dead_letter, nothing delivered (delivered_sent=0, P6).
• Replay — fn_iu_route_dead_letter_replay is fail-closed and resolves on a dry-run outcome (P7).
• Healthcheck — fn_iu_route_worker_health reflects gates + audit (P5/L8).

Durable footprint of this macro

Worker gate false→true; cursor last_run_at/last_run_summary set by the 090 run. Zero iu_route_attempt, iu_route_dead_letter, or event_outbox rows. Final durable confirmation: cursor keyset NULL, route enabled+dry_run, route safety CHECK present, audit 0/0/0.

Durable dry-run attempt evidence — safe deferral

Objective 4 ("durable iu_route_attempt dry_run rows") is safely deferred. A durable dry_run attempt needs a durable iu event, which requires either an organic version_seq>1 unit_version insert (forbidden — no lifecycle mutation) or a synthetic non-organic row in the shared append-only event_outbox (not "inert metadata", unremovable, false audit data, and contrary to doc 08's organic evidence requirement). The BEGIN…ROLLBACK probe gives full functional proof without that cost.