07 — ROLLBACK / RETIRE / CLEANUP PLAN

This entire lane is disposable. Nothing here is official runtime. Rollback is total and cheap. On-disk copy: /opt/incomex/staging/c1/ROLLBACK.md.

A. Retire a single sandbox (normal cleanup, after a dry-run)

/opt/incomex/staging/c1/bin/dot-staging-sandbox-drop --sandbox-id c1_staging_<ts>

Governed retire: refuses any non-c1_staging_* DB and any DB without an active sbx_meta registry row; captures a tombstone to /opt/incomex/staging/c1/_tombstones.jsonl; appends sandbox_drop to the ledger; DROP DATABASE ... WITH (FORCE); readback-confirms gone; orphan sweep.

B. TTL

24h from each sandbox's sbx_meta.birth_certificate.created_at. After TTL, run A.

C. Emergency raw equivalent (audit reference — prefer A)

DROP DATABASE c1_staging_<ts> WITH (FORCE);

D. Full lane teardown (remove the staging deployment itself)

# 1) drop any live sandboxes (loop A over each c1_staging_* DB)
# 2) rm -rf /opt/incomex/staging/c1

Official runtime stays untouched (the lane never wrote to directus / dot_tools / dot/bin / any official registry).

E. Nothing to revert in official runtime

• No official dot_tools row created (registry is staging JSONL only).
• No /opt/incomex/dot/bin deploy.
• No Directus / CAT-006 / dot_agent_api_contract change.
• No APR / quorum / grant created; APR-0415 untouched. → before == after; rollback of official runtime is a no-op.

F. Current state to roll back from (this macro)

Only the staging deployment exists (/opt/incomex/staging/c1/, 18 files) and this KB package. No sandbox DB exists yet (staging_DBs=0), so even the per-sandbox retire (A) has nothing to act on until the dry-run runs. To undo this macro entirely: rm -rf /opt/incomex/staging/c1 (+ optionally delete this KB package). That returns the system to the exact prior STAGED state.