dot-iu-cutter v0.5 — Pre-Scale Index Rollback Plan

Date: 2026-05-17 · Status: PLAN ONLY — nothing executed. Parent: index-ddl-draft.

1. Why rollback is clean here

The change is purely additive secondary indexes. The exact inverse of CREATE INDEX is DROP INDEX of the same named object — no data, schema, constraint, or semantic state is affected. Dropping the 7 indexes returns the catalog byte-for-byte to baseline (8 indexes on the 6 tables, zero data/column/constraint delta). No forward-compensation needed (this is not an append-only ledger write; it is reversible DDL).

2. Rollback DDL (PROPOSED, NOT executed) — exact inverse, deterministic names

Standalone statements; must NOT run inside a transaction (DROP INDEX CONCURRENTLY shares the CIC restriction). IF EXISTS ⇒ idempotent / safe if a create never happened or already rolled back.

DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_dbe_status_emitted_keyset;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_me_source_doc_ref;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_rd_manifest_id;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_ccs_dbe_id;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_vr_change_set_id;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_dps_xref_cs;
DROP INDEX CONCURRENTLY IF EXISTS cutter_governance.idx_dps_xref_vr;

3. Triggers / disposition

• Verification FAIL (any V/A gate) → roll back all 7 by the above (exact-name), re-assert baseline (index count back to 8; data/schema unchanged), honest failure report.
• Partial create (CIC interrupted → one INVALID index) → the same DROP INDEX CONCURRENTLY IF EXISTS removes the INVALID object; created-valid ones either kept (if continuing the cycle) or dropped (if aborting) — decided by the execution command-review, default = full rollback of the set on any abort.
• No DROP CONCURRENTLY inside txn, by exact name only — never DROP … CASCADE, never wildcard, never by pattern. Each drop independent.

4. Safety properties

• Exact-name only; no CASCADE (an index has no dependents to cascade anyway; explicit guard against accidental object loss).
• IF EXISTS ⇒ rollback is idempotent and safe to re-run.
• Dropping a secondary index cannot lose data or break a constraint (none of the 7 backs a constraint — asserted by verification V-8).
• Concurrency: DROP INDEX CONCURRENTLY takes SHARE UPDATE EXCLUSIVE; reads/writes continue; safe online; not transactional (run per-statement).
• Baseline restorability proven structurally (index-count == 8 on the 6 tables; row/column/constraint sets == pre).

5. Decision

• D-4 rollback model: DROP INDEX CONCURRENTLY IF EXISTS <schema.name> per index, exact-name, no CASCADE, not in txn — made (recommended; matches the additive nature and CIC constraints). Production restore from backup is not the rollback path here (no data at risk); a fresh pre-cycle backup is still taken by the execution cycle purely as an unrelated disaster backstop.

Boundaries / Git

Plan only — nothing executed. Git main · e93424b5ff7fa5e4b8406131977ce4339cd0856a · clean (0 lines). No hardcoding; additive/reversible; SQL=SSOT; no vector/NoSQL. Next = GPT review.