dot-iu-cutter v0.5 WS-Q5 Registry Substrate — Production Rollback Command Package

Phase: v0_5_WS_Q5_registry_substrate_production_preflight_and_command_package · Date: 2026-05-18 Exact inverse of: production-apply-command-package (this file).

⚠️ GATING BANNER — DO NOT EXECUTE

phase: production_command_package_authoring
sql_executed: none                 # QG4
rollback_executed: false
cascade_used: false                # QG5 — NO CASCADE
execution_authorized: false
self_advance: PROHIBITED
decision_authority: GPT / User ONLY

Exact inverse of the production apply package. DO NOT EXECUTE unless a separate sovereign authorization for rollback is granted. DROP order = strict reverse of create order, so every FK child is dropped before its FK parent — no CASCADE required and none used (QG5).

---

1. Pre-state assumption & data-exists doctrine (escalate, do not hard-delete)

designed_for: rollback of the FIRST apply, where all 12 registry tables are
  freshly created and EMPTY (this package authors NO DML seed).
empty_table_case: exact-inverse DROP TABLE is the true inverse and fully safe;
  zero data loss (tables were empty).
data_exists_case (future — after a separate seed/use cycle):
  - DO NOT hard-DROP a registry that holds governed config rows.
  - Per project no-hard-delete doctrine: prefer row-level lifecycle='deprecated'
    (append-only audit trail), supersede with corrected rows, or quarantine.
  - A structural rollback that would drop a NON-EMPTY registry is an
    ESCALATION to GPT/User, NOT an automatic step.
guardrail: the apply command-review MUST capture a pre-state snapshot + backup
  sha before apply; every rollback step is itself sovereign-gated, never auto-run.
precondition_check_before_drop:
  SELECT relname, n_live_tup FROM pg_stat_user_tables
   WHERE schemaname='cutter_governance'
     AND relname IN (<the 12 WS-Q5 tables>);
  -- if ANY > 0 rows -> STOP, escalate (deprecate, do not drop)

2. Rollback SQL — exact inverse, reverse dependency order (DO NOT EXECUTE)

-- ============================================================================
-- dot-iu-cutter v0.5 WS-Q5 Registry Substrate — PRODUCTION ROLLBACK
-- Exact inverse of production apply. Reverse dependency order. NO CASCADE.
-- Precondition: all 12 target tables EMPTY (first-apply rollback). If any
-- holds rows -> STOP + escalate (lifecycle='deprecated'), do NOT hard-drop.
-- Run with: psql -v ON_ERROR_STOP=1   DO NOT EXECUTE without sovereign auth.
-- ============================================================================

BEGIN;

DROP TABLE cutter_governance.metadata_key_registry;                 -- inverse of create 12
DROP TABLE cutter_governance.authority_override;                    -- inverse of create 11
DROP TABLE cutter_governance.entity_reference_registry;             -- inverse of create 10 (FK -> entity_kind_registry)
DROP TABLE cutter_governance.entity_kind_registry;                  -- inverse of create 9
DROP TABLE cutter_governance.source_document_version_registry;      -- inverse of create 8 (FK -> source_document_registry)
DROP TABLE cutter_governance.source_document_registry;              -- inverse of create 7 (FK -> source_family_registry)
DROP TABLE cutter_governance.source_family_registry;                -- inverse of create 6 (FK -> grammar_profile)
DROP TABLE cutter_governance.grammar_profile_status_marker;         -- inverse of create 5 (FK -> grammar_profile)
DROP TABLE cutter_governance.grammar_profile_level;                 -- inverse of create 4 (FK -> grammar_profile, matcher_config_registry)
DROP TABLE cutter_governance.grammar_profile;                       -- inverse of create 3 (FK -> address_template_registry)
DROP TABLE cutter_governance.address_template_registry;             -- inverse of create 2
DROP TABLE cutter_governance.matcher_config_registry;               -- inverse of create 1

COMMIT;

-- No CASCADE. Each DROP succeeds because all referencing children were dropped
-- earlier. pk_/fk_/uq_ constraints drop implicitly WITH their owning table —
-- no separate constraint DROP, no orphan. Schema cutter_governance is NOT
-- dropped (it pre-existed and is shared with the other 12 tables).
-- END ROLLBACK  (12 DROP TABLE; 0 CASCADE; 0 data assumed)

3. Inverse-correctness proof (catalog-level intent)

create_order:   1 mcr -> 2 atr -> 3 gp -> 4 gpl -> 5 gpsm -> 6 sfr -> 7 sdr -> 8 sdvr -> 9 ekr -> 10 err -> 11 ao -> 12 mkr
rollback_order: 12 mkr -> 11 ao -> 10 err -> 9 ekr -> 8 sdvr -> 7 sdr -> 6 sfr -> 5 gpsm -> 4 gpl -> 3 gp -> 2 atr -> 1 mcr
property: rollback_order == reverse(create_order) -> every FK child dropped
  before its FK parent -> DROP TABLE valid WITHOUT CASCADE for all 12.
post_rollback_expected:
  cutter_governance back to pre-apply 12 tables (canonical_address_alias,
  cut_change_set, cut_change_set_affected_row, decision_backlog_dependency,
  decision_backlog_entry, decision_backlog_history,
  decision_backlog_sweep_log, dot_pair_signature, manifest_envelope,
  manifest_unit_block, review_decision, verify_result);
  the 12 new objects + all pk_/fk_/uq_ constraints absent;
  baseline constraint counts restored to p=12 / f=19 / u=2 / c=1;
  views (v=12) UNCHANGED; system_identifier 7611578671664259111 UNCHANGED;
  zero data loss (tables were empty).
no_check/trigger/default/sequence/enum created by apply -> none to reverse.

4. Statements

• QG4: nothing executed. QG5: rollback is exact inverse, reverse-ordered, NO CASCADE; no default/trigger/sequence/enum to reverse; non-empty-table case routes to deprecate/escalate, not hard drop.
• No DML, no Directus mutation, no privilege/role change reversal (none authored in apply). Schema not dropped.
• Self-advance PROHIBITED — doc 3 of 5; rollback NOT executed and requires separate sovereign authorization. STOP → route GPT/User.

Companion files: preflight-result, production-apply-command-package, verification-command-package, command-review-report.