dot-iu-cutter v0.5 — Canonical CUT Execution · Rollback / Compensation Status

doc 6 of 7 · 2026-05-20

phase                : R-state determination
outcome              : NO ROLLBACK NEEDED · NO COMPENSATION NEEDED
production_mutation  : the 60 IU + 60 UV + 60 anchor entries from attempt-2
                       are now the authoritative constitution birth set

1. Two attempts — distinct R-states

G6 attempt-1 (autocommit=True provider — silent server-side rollback) :
  regime              : soft R-2 (pre-commit ; server rolled back the open
                        txn on libpq disconnect when the python process exited)
  rows_persisted      : 0
  compensation_needed : NO (no commit happened)
  evidence            : post-attempt-1 query showed iu_total=98 unchanged,
                        recent_iu=0, max(created_at) on IU = 2026-05-14
                        (PRE-EXECUTION baseline ; no canonical-cut rows)
  resolution          : in-scope provider patch (autocommit=False) + verified
                        rollback-only re-test + attempt-2 ; documented in
                        doc 4 §§3-5

G6 attempt-2 (autocommit=False patched provider — COMMITTED) :
  regime              : NOT a failure regime ; CUT_OK_LEG_A_CANONICAL
  rows_persisted      : 60 IU + 60 UV + 60 anchors + 60 birth_registry
  compensation_needed : NO (R-1 / R-2 / R-3 doctrine not engaged)

2. R-1 / R-2 / R-3 evaluation

Per the rollback doctrine inherited from the earlier production-legA package (rerun macro doc 6 §1 and survey package doc 7 §5) :

regime	condition	this macro
R-1	pre-connect guard fails ; no connect	NO — attempt-1 connected, attempt-2 connected
R-2	connection opened ; in-tx guard/trigger raises ; atomic ROLLBACK	"Soft R-2" applied to attempt-1 only (no in-tx raise, but conn.commit() NO-OP + server-side rollback at disconnect — same observable end state: zero persistence)
R-3	COMMIT succeeded ; out-of-band anomaly later ; forward-compensation only	NO — attempt-2 committed cleanly and G7 ALL CHECKS PASS

R-3 doctrine remains the future-proofing path : if any out-of-band anomaly is later discovered against the 60 committed rows, the next sovereign-gated package must apply FORWARD COMPENSATION ONLY (no DELETE / TRUNCATE on public.* ; supersede via fn_iu_apply_edit_draft or higher-level state machine).

3. Backup preservation

backup_path                : /opt/incomex/backups/pg/directus_legA_cut_canonical_pre_grant_20260520T040918Z.dump
backup_sha256              : ba0ef355e7511cb7cac2d72c2f5e236e3ab98df69f64a02dcb92e38503158490
backup_bytes               : 74384
backup_taken_utc           : 2026-05-20T04:09:18Z
preserved_for_audit        : YES (and for catastrophic-breach restore per
                              the prior package doc 5 §4 — sovereign
                              declaration only)

4. Invariants preserved this macro

no_physical_DELETE                                : honored
no_TRUNCATE                                       : honored
no_DDL / DROP / ALTER on tables                   : honored
no_role / membership / password / pg_hba change   : honored
no_GRANT/REVOKE outside the approved doc 4 §3 delta : honored
no_direct_INSERT into IU/UV (bypassing gateway)   : honored — all writes via fn_iu_create
no_UPDATE on unit_version                         : honored (fn_iu_create writes UV only at v1)
no_UPDATE on IU non-anchor columns                : honored (only anchor UPDATE inside fn_iu_create)
no_source_document_* mutation                     : honored
no_Directus / vector / NoSQL write                : honored
no_deploy / restart / docker rebuild              : honored (sidecar python:3.12-slim
                                                     was --rm ephemeral ; postgres
                                                     container untouched)
no_merge / push / tag                             : honored (feature branch HEAD
                                                     f20c79c unchanged ; 3 canonical
                                                     files remain untracked)
no_secret_echo / argv_leak / log_leak             : honored
no_VERIFY                                         : honored (cutter_verify VW-* not run)
no_post_CUT_governed_recording                    : honored (leg-B not run)
no_gateway_bypass                                 : honored — every write went via
                                                     fn_iu_create SECURITY DEFINER
                                                     path that legally sets the
                                                     `app.canonical_writer` marker

5. Disposition

rollback_required          : NO  (no state to revert ; clean commit)
compensation_required      : NO  (R-3 doctrine not engaged)
REVOKE_post_CUT            : NOT required by this macro. The canonical GRANT
                              delta (EXECUTE on fn_iu_create) is the steady-
                              state production posture for the cutter_exec
                              role — this is the architectural target per
                              the survey package, not a transient grant.
                              Any future REVOKE is a separately sovereign-
                              gated decision.
backup_preserved           : YES
provider_module            : keep ; future canonical CUTs (e.g. v0.5 leg-B
                              or other docprefixes) can reuse the patched
                              module at sha 26ebb918f9a0…
production_mutation_state  : 60 ICX-CONST rows + 60 UV(v1) + 60 anchors +
                              60 birth_registry ; G5 GRANT delta still in
                              place (intentional steady state)
self_advance               : PROHIBITED for any further mutation
next_action                : reports + STOP per prompt

doc 6 of 7.