10 — C1 Rollback / Dismantle / Clean-State Proof — 2026-06-22

LABELS: LOCAL_DISPOSABLE_SANDBOX_DOT_EMULATOR · NOT_GOVERNED_RUNTIME · NOT_PRODUCTION · NOT_DIRECTUS_GOVERNED_WRITE · NOT_A_SUBSTITUTE_FOR_DOT_C1_REGISTRATION

Sequence (executed, verbatim results)

step	action	result
1	baseline	vocab_before_apply = 0
2	valid SANDBOX_APPLY (G_VALID)	{outcome:SANDBOX_APPLIED, rows_written:14, audit_id:1, seal:b343316525b0c5…dea23a, manifest_hash:c9286d3a…ec00}
3	state created	vocab_after_apply = 14
4	reuse consumed G_VALID	REJECT_AUTH_ALREADY_CONSUMED; vocab_after_reuse_attempt = 14 (no new rows — single-use holds)
5	prod-style RETIRE (versioned)	UPDATE 1 — status='retired', superseded_by='c1.op.create_item@2' (allowed)
6	semantic rewrite attempt	NOTICE: write_once_guard fired: C1_WRITE_ONCE_VIOLATED (handler_ref rewrite blocked)
7	sandbox DISMANTLE (disposable)	DELETE 14; vocab_after_dismantle = 0
8	audit retained	audit_rows_retained = 1 (audit row #1 kept: plan LEGO1-C1-PLAN, mode SANDBOX_APPLY, rows 14, hash c9286d3a…)

Clean-state / no-orphan proof

vocab_rows=0 | active_grants_left=7 | audit_rows=1 | orphan_rows=0

• vocab back to baseline (0).
• no orphan rows (orphan_rows=0: every former row's source_action_code ∈ authority fixture; none dangling).
• audit retained across dismantle (immutable evidence).
• no C2/C3 side-effect: only schema c1 objects touched; no cross-carrier writes (and c2_cross_mutation is rejected upstream — file 09).

Two rollback semantics distinguished

1. Production-style validity rollback = versioned retire-with-successor (no destructive delete) — step 5; semantic rewrite blocked by write-once trigger — step 6.
2. Sandbox dismantle = destructive DELETE of the disposable sandbox state — step 7 — explicitly authorized for test/sandbox cleanup and valid only because the lane is disposable.

Scope note

This proves rollback/dismantle logic and clean-state in the sandbox. The governed-runtime rollback (versioned retire on the real governance_canonical_operation_vocab) is not demonstrated — that collection does not exist on governed runtime.