E — Trigger In / Out + DLQ Replay Evidence

Capability: prove IU trigger-out and trigger-in readiness; refs-only payload; DLQ/failure path; no real route delivery; no job execution. Verdict: PASS. Channel: governed BEGIN … ROLLBACK via workflow_admin. Persisted mutation: none.

E.1 Method

One transaction with SET LOCAL timeouts; emit + worker + DLQ replay against an isolated test worker and isolated DLQ rows; then ROLLBACK. No production route enabled for real delivery; no job executed. Script in 07-raw-sql-dot-appendix.md.

E.2 Functions / tables

• fn_iu_emit_event(event_type, canonical_address, subject_ref uuid, actor_ref, safe_payload jsonb) RETURNS uuid → writes event_outbox (sources event_stream/delivery_lane from event_type_registry; refs-only).
• fn_iu_route_worker_run(worker_name, batch_limit) RETURNS jsonb → cursor-based; per-event isolation; dry_run route → records attempt, no delivery; exception → dead-letters the event.
• fn_iu_route_dead_letter_replay(dead_letter_id) RETURNS jsonb → gated only by the master routes gate; dry_run route → resolves; missing route → skipped.
• Trigger-in: trg_iu_sql_in_iu_sql_link AFTER INSERT ON iu_sql_link FOR EACH ROW EXECUTE FUNCTION fn_iu_sql_link_inbound_capture(); inbound route iu_sql.iu_sql_link.insert.

E.3 TRIGGER-OUT — emit (refs-only payload)

fn_iu_emit_event('structure_piece_split','TEST/iu-demo/brick-gamma','bc79ab1c…','iu_demo_harness', {refs-only payload}) → event_id a539c785-37b0-4dfb-83c2-8d151b4a1444. Emitted event_outbox row:

event_type=structure_piece_split  event_stream=update  delivery_lane=immediate
payload_classification=safe_metadata   event_subject_table=information_unit   actor_ref=iu_demo_harness
safe_payload={"note":"refs-only: no body, no secret, no vector","reason":"A-F demo",
              "child_refs":["TEST/iu-demo/brick-gamma-1","TEST/iu-demo/brick-gamma-2"],"child_count":2}

Refs-only proven: payload carries canonical refs + counts only; classification safe_metadata; the outbox schema has no body/secret/vector column.

E.4 Matching route (dry_run)

iu.structure_piece_split.workflow — enabled=true, dry_run=true, target_kind=workflow, target_ref=event_outbox.

E.5 TRIGGER-OUT — delivery via isolated dry-run worker

A dedicated worker iu_demo_e_worker had its cursor pre-seeded to the latest pre-existing event so it sees only the emitted event. fn_iu_route_worker_run('iu_demo_e_worker', 10):

{ status:ran, seen:1, attempts_written:1, skipped:0, dead_lettered:0, cursor_event_id:a539c785… }

Resulting iu_route_attempt for our event: route_code=iu.structure_piece_split.workflow, status=dry_run, error_code=NULL, delivered=false, target_ref=event_outbox. Routed, recorded, NOT delivered.

E.6 DLQ failure path + replay (isolated)

Two dead-letter rows inserted (refs-only event_snapshot):

idempotency_key	route_code	before
iu_demo:dlq:unrouted	iu.test_iu_demo.unrouted (not registered)	unresolved, attempts 1
iu_demo:dlq:dryrun	iu.structure_piece_split.workflow (dry_run)	unresolved, attempts 1

Replays:

• fn_iu_route_dead_letter_replay(unrouted) → {status:replayed, decision:skipped, resolved:false} → DLQ stays unresolved, attempts→2. (failure path: no route → not resolved, event preserved.)
• fn_iu_route_dead_letter_replay(dryrun) → {status:replayed, decision:dry_run, resolved:true} → DLQ resolution='replayed', attempts→2. (resolution path via dry_run, no delivery.)

E.7 TRIGGER-IN readiness (wiring proof)

• Trigger present: CREATE TRIGGER trg_iu_sql_in_iu_sql_link AFTER INSERT ON public.iu_sql_link FOR EACH ROW EXECUTE FUNCTION fn_iu_sql_link_inbound_capture().
• Inbound route present: iu_sql.iu_sql_link.insert (source table / insert → target_event_type sql_link_created, enabled=false, dry_run=true). This is the trigger-in seam: an INSERT on iu_sql_link fires inbound capture, which the inbound route maps to a sql_link_created IU event. Live capture-on-insert was proven in the prior iu-d-e-f-remaining-governed-live-test-suite session (F.3b); here it is verified as wired and route-registered.

E.8 Safety — no real delivery, no job execution

iu_core.delivery_enabled=false, iu_core.delivery_live_routes="" (empty). Our event produced 0 sent attempts (only dry_run). All routes remained enabled+dry_run; no route was enabled for real delivery; the master delivery seam (fn_iu_route_deliver) was never reached. No job substrate executed (queue.job_substrate.enabled=false).

Note: a single historical iu_route_attempt with delivered=true exists in the pre-existing baseline (among the 68 baseline attempts) — it is not from this demo; all 3 attempts produced by this demo are dry_run/skipped with delivered=false.

E.9 In-tx deltas / post-rollback

	event_outbox	iu_route_attempt	iu_route_dead_letter	demo_cursor
E0 baseline	156230	68	0	—
E7 in-tx	156231	71	2	1
E8 post-ROLLBACK	156230	68	0	0
Nothing persisted.

E.10 What a human can look at

The event_outbox row shows a clean refs-only event; the worker summary + iu_route_attempt show routing without delivery; the two DLQ rows + replay returns show both the "stuck on missing route" failure and the "replayed via dry_run" resolution. Post-rollback counts prove zero footprint.