06 — After snapshot + rollback/retire

After snapshot (live, db=directus, end of macro) — before == after

No governed mutation was performed, so the after-state equals the before-state (file 01 §B).

metric	before	after	Δ
authorize_build_step.handler_ref	unimplemented	unimplemented	none
apr_action_types total	14	14	0
apr_action_types unimplemented	10	10	0
governance_build_authorization grants	0	0	0
approval_requests total	230	230	0
approval_requests (proposed_action_code=authorize_build_step)	0	0	0
dot_tools total	309	309	0
dot-c1-grant-issue / dot-c1-* rows	0 / 0	0 / 0	0
dot_agent_api_contract total	2	2	0
table_registry total	21	21	0
directus_collections total	164	164	0

(The after values are asserted from the fact that no write tool was exercised against any governed surface; the same RO queries that produced §B in file 01 define both columns. A re-SELECT would return the identical rows.)

Rollback / retire

• Nothing was applied ⇒ nothing to roll back. No code deployed, no handler_ref bound, no DOT registered, no grant minted, no ledger row written.
• Fail-closed state intact: with handler_ref='unimplemented', trg_apr_block_unimplemented blocks any apply (apply-time quorum re-proof + RAISE on unimplemented), and the dot-apr-execute dispatcher *) default catches any unbound routing key. Staged artifacts remain staged.
• Rollback commands (for the LATER owner-authorized apply, reverse order — recorded per file 08 §A):
  1. revoke grant: UPDATE governance_build_authorization SET status='revoked', revoked_at=now(), revoked_reason='rollback' WHERE auth_code='GBA-C1-<apr>' (via governed path).
  2. unbind: UPDATE apr_action_types SET handler_ref='unimplemented' WHERE action_code='authorize_build_step' (via governed migration).
  3. restore code: mv /opt/incomex/dot/bin/dot-apr-execute.bak-<session> /opt/incomex/dot/bin/dot-apr-execute (via governed deploy). These are for the operator at apply time — none was needed this turn.
• New-DOT retire path (dot-c1-grant-issue): status-flip retire / status=revoked; not registered this turn, so no retire needed.

Orphan check

• 0 DOTs registered this turn ⇒ 0 orphan DOTs introduced. The staged dot-c1-grant-issue remains a disclosed, unregistered design artifact (file 04), not a live orphan in dot_tools/CAT-006.