dot-iu-cutter v0.5 — Constitution Source Seed FROM SNAPSHOT: REVISED Rollback / Compensation

Phase: v0_5_constitution_source_seed_from_snapshot_DML_revision · Date: 2026-05-18 · doc 2 of 4

revises: v0.5-constitution-source-document-seed-from-snapshot-authoring/…-rollback-draft-2026-05-18.sql.md
per_ruling: dot-iu-cutter-v0.5-constitution-source-seed-from-snapshot-command-review-gpt-ruling-2026-05-18.md
change: confirm rollback targets the LITERAL document_version_id (matches revised DML);
        no DB sha256 anywhere; method otherwise unchanged
nature: ROLLBACK DRAFT — NOT executed ; dml: none run ; dry_run: none
method: exact inverse, child-before-parent, single tx, NO CASCADE
decision_authority: GPT / User ONLY ; self_advance: PROHIBITED

The authoring rollback already keyed on the literal document_version_id; it stays valid. This revision re-issues it aligned to the revised DML and makes explicit that no sha256() is computed anywhere in rollback (identity match is on the stored literal). Method (child-first, no CASCADE, exact-count guard) unchanged.

---

1. Exact rollback target (the revised-DML seed delta)

seed_delta:
  +1 cutter_governance.source_document_registry
       source_document_ref='incomex-constitution', address_docprefix='ICX-CONST'
  +1 cutter_governance.source_document_version_registry
       source_document_ref='incomex-constitution'
       content_checksum='17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c'
       document_version_id='icxconst-008a06ace23a96ea6cd456146e805c97'   (LITERAL — same value the revised DML inserts)
fk: source_document_version_registry.source_document_ref
    -> source_document_registry.source_document_ref  (fk_sdvr_source_document)
    => child (version) MUST be deleted BEFORE parent (document)
note: rollback matches the stored literal document_version_id directly; it does
  NOT recompute sha256. The pinned SNAPSHOT artifact is NOT a rollback target
  (write-once KB artifact, E1 CLOSED_PASS) — rollback never deletes/mutates it.

2. Preconditions before any rollback (ALL must hold)

RB-P1 exact identity match (literal, no hashing):
  source_document_registry: source_document_ref='incomex-constitution'
    AND address_docprefix='ICX-CONST' AND registered_by='constitution-source-seed'
  source_document_version_registry: source_document_ref='incomex-constitution'
    AND content_checksum='17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c'
    AND document_version_id='icxconst-008a06ace23a96ea6cd456146e805c97'
    AND registered_by='constitution-source-seed'
RB-P2 NO downstream references to either row:
  - no IU / iu_provenance rows bound to this document_version_id
  - no manifest_envelope / manifest_unit_block / cut artifact referencing it
  - no OTHER source_document_version row for 'incomex-constitution'
RB-P3 row counts are exactly the seed delta (+1 doc, +1 version), no extras
  (else: production-state mismatch -> STOP and report, do NOT delete)

3. Rollback path A — clean DELETE (preferred; only if RB-P1..P3 ALL hold)

-- NOT EXECUTED. Exact inverse of the revised-DML seed. Child first, then parent.
-- Identity match is on the stored LITERAL document_version_id (no sha256 call).
\set ON_ERROR_STOP on
BEGIN;

DELETE FROM cutter_governance.source_document_version_registry
 WHERE source_document_ref = 'incomex-constitution'
   AND content_checksum    = '17660443e0f23e994e1807cf8e22920951a9e70c598956dbd0e752f4f5cae80c'
   AND document_version_id = 'icxconst-008a06ace23a96ea6cd456146e805c97'
   AND registered_by       = 'constitution-source-seed';
-- expect: DELETE 1

DELETE FROM cutter_governance.source_document_registry
 WHERE source_document_ref = 'incomex-constitution'
   AND address_docprefix   = 'ICX-CONST'
   AND registered_by       = 'constitution-source-seed';
-- expect: DELETE 1

COMMIT;
-- expect: DELETE 1 ; DELETE 1 ; COMMIT  -> registry back to 0 / 0

4. Rollback path B — compensation (ONLY if RB-P2 fails: downstream refs exist)

condition: downstream references exist -> a clean DELETE would break referential/audit integrity
action: do NOT DELETE. Instead lifecycle-retire the parent (schema supports it):
  UPDATE cutter_governance.source_document_registry
     SET lifecycle='deprecated'
   WHERE source_document_ref='incomex-constitution'
     AND address_docprefix='ICX-CONST';
version_row: source_document_version_registry has NO lifecycle column live ->
  cannot be lifecycle-retired. version_status MAY be set to a non-cut value
  (e.g. 'void') and provenance->>'rollback_note' recorded — ONLY if GPT approves
  at command-review. Path B is NOT clean rollback.
gate: Path B requires an explicit GPT ruling at command-review (open item RB-B).
escalation: downstream refs exist AND Path B not pre-approved ->
  STOP_AND_ESCALATE to GPT/User; take no compensating write.

5. Method constraints

- no CASCADE, no TRUNCATE, no DROP
- single transaction, child-before-parent, ON_ERROR_STOP armed
- NO sha256/pgcrypto anywhere (identity match on stored literal)
- no GRANT/REVOKE, no schema change, no Directus mutation, no index DDL
- pinned snapshot artifact is write-once: NEVER deleted/edited by rollback
- identity match on (source_document_ref, content_checksum, document_version_id,
  registered_by) — never on a rendered/observed string
- if any DELETE affects != 1 row -> ABORT (ROLLBACK), report mismatch

6. Statement

• Rollback re-issued aligned to the revised DML: targets the literal document_version_id='icxconst-008a06ace23a96ea6cd456146e805c97', no sha256 anywhere, child-before-parent, no CASCADE, exact-count guard (QG2/QG5 preserved). Path A clean DELETE + Path B compensation complete. Write-once snapshot artifact out of rollback scope. Nothing executed (QG6).
• doc 2 of 4; STOP after 4 files → route GPT/User. Self-advance PROHIBITED.

Companion: DML-revised, verification-plan-revised, DML-revision-report.