dot-iu-cutter v0.4 — MARK/SWEEP/REVIEW/CUT/VERIFY Schema-Binding Plan

Date: 2026-05-17 · DESIGN ONLY (no code/commit/dry-run/provision). Per-phase ordering, FK dependency, principal, isolation, transaction & rollback implication for the canonical flow under the rebinding. Phases are unchanged structurally; only LedgerWriter row payloads (9 writers) + a few threaded args (SB-DEC-5/6) + the real-schema lineage read (SB-DEC-1) change in the later code cycle.

1. Per-phase write sequence (FK-correct order; one atomic txn each)

MARK — principal cutter_exec, isolation READ COMMITTED

1. append_entry → decision_backlog_entry (MATCH) — parent row (PK entry_id).
2. append_history (BIRTH→marked) → decision_backlog_history (rebind) — FK entry_id satisfied by step 1 (same txn).

Rows: entry +1, history +1. Rollback: whole-phase abort ⇒ both vanish (atomic).

SWEEP — principal cutter_exec, isolation (READ COMMITTED; sweep() opens its own txn)

1. cas_status (marked→review_pending) on decision_backlog_entry (MATCH, sanctioned column UPDATE).
2. append_history (marked→review_pending) → decision_backlog_history (rebind).
3. append_sweep_log → decision_backlog_sweep_log (rebind).

Rows: history +1, sweep_log +1. CAS predicate status='marked'; rowcount!=1⇒AppendOnlyViolation⇒rollback (no partial sweep).

REVIEW — principal cutter_exec, isolation READ COMMITTED

1. insert_manifest_envelope → manifest_envelope (rebind; source_doc_ref=entry_id SB-DEC-1).
2. insert_manifest_unit_block ×1 → manifest_unit_block (rebind; FK envelope_id→step 1; composite PK (envelope_id,unit_local_id); render_order SB-DEC-5).
3. insert_review_decision → review_decision (rebind; FK manifest_id→envelope step 1; unit-local NULL ⇒ composite FK to unit_block skipped).
4. cas_status (review_pending→reviewed_approved) + append_history (rebind). (Re-review only: update_review_superseded_by_if_any — MATCH; 0× canonical.)

Rows: envelope +1, unit_block +1, review_decision +1, history +1. FK order strict: 1→2→3. Rollback: any failure ⇒ whole REVIEW txn abort (all 4 vanish).

CUT — principal cutter_exec, isolation SERIALIZABLE

1. insert_dot_pair_signature (executor, lane DOT-991) → dot_pair_signature (rebind).
2. insert_cut_change_set → cut_change_set (rebind; FK executor_signature_id→step 1; FK decision_backlog_entry_id→entry; NN review_decision_id threaded SB-DEC-6; UNIQUE rollback_key/idempotency_key deterministic).
3. insert_cut_change_set_affected_row ×1 → cut_change_set_affected_row (rebind; FK change_set_id→step 2).
4. cas_status (reviewed_approved→cut_applied) + append_history (rebind).

Rows: dot_pair_signature +1, cut_change_set +1, affected_row +1, history +1. FK order 1→2→3. SERIALIZABLE; rollback ⇒ all vanish; 40001 ⇒ bounded whole-phase retry (idempotency_key converges).

VERIFY — principal cutter_verify, isolation SERIALIZABLE (separate connection/role)

1. insert_dot_pair_signature (verifier, lane DOT-992) → dot_pair_signature (rebind).
2. insert_verify_result (pass) → verify_result (rebind; FK change_set_id→cut_change_set [prior CUT txn, committed], verifier_signature_id→step 1; NN manifest_id/review_decision_id threaded from cs SB-DEC-6).
3. cas_status (cut_applied→verified_complete) + append_history (rebind).

Rows: dot_pair_signature +1 (→ total 2), verify_result +1, history +1. Pass branch: no compensating cut_change_set, no escalation decision_backlog_entry. Rollback ⇒ all vanish; cutter_verify cannot write review_decision/manifest_* (frozen matrix; G-18).

2. Cumulative matrix (unchanged from r3 — binding is column-level only)

Table	MARK	SWEEP	REVIEW	CUT	VERIFY
decision_backlog_entry	1	1	1	1	1
decision_backlog_history	1	2	3	4	5
decision_backlog_dependency	0	0	0	0	0
decision_backlog_sweep_log	0	1	1	1	1
manifest_envelope	0	0	1	1	1
manifest_unit_block	0	0	1	1	1
review_decision	0	0	1	1	1
dot_pair_signature	0	0	0	1	2
cut_change_set	0	0	0	1	1
cut_change_set_affected_row	0	0	0	1	1
verify_result	0	0	0	0	1
canonical_address_alias	0	0	0	0	0
total	2	4	8	12	15

Identical to verification-plan r3 §2.2/§2.3. The binding does not change any count ⇒ r3 stays the execution gate without revision.

3. Principal / isolation / capability cross-check (unchanged)

PHASE_PRINCIPAL (MARK/REVIEW/CUT→cutter_exec, VERIFY→cutter_verify) and PHASE_ISOLATION (MARK/REVIEW=READ COMMITTED, CUT/VERIFY=SERIALIZABLE) in db_adapter.py are untouched. _EXEC_INSERT_TABLES/_VERIFY_INSERT_TABLES already enumerate exactly the deployed tables each phase writes; the rebinding writes the same tables, so the frozen capability inventory and the live privilege matrix (cutter_exec 18 table-priv+2 col-UPDATE; cutter_verify 15+1; cutter_ro NOLOGIN+13) remain exact (G-17). SWEEP's cas_status+append_history+append_sweep_log are all cutter_exec and all in _EXEC_INSERT_TABLES ∪ {status UPDATE} — no privilege change.

4. FK dependency summary (drives intra-phase ordering)

decision_backlog_history.entry_id→entry · manifest_unit_block.envelope_id→envelope · review_decision.manifest_id→envelope (and skipped composite→unit_block when unit-local NULL) · cut_change_set.executor_signature_id→signature, .decision_backlog_entry_id→entry · cut_change_set_affected_row.change_set_id→change_set · verify_result.change_set_id→change_set, .verifier_signature_id→signature, NN .manifest_id/.review_decision_id (no FK but threaded for correctness). All satisfiable within each phase's single atomic txn in the order in §1; cross-phase FKs (verify→cut_change_set) reference prior committed phases.

5. Verdict (this doc)

The 5-phase flow binds cleanly to the deployed schema with FK-correct intra-phase ordering, unchanged principal/isolation/capability, unchanged counts (r3 preserved), append-only, no migration. Resume condition: the later code-authoring cycle implements the §1 rebindings + SB-DEC-1/5/6; then command-review r1 + verification-plan r3 run as-is.