dot-iu-cutter v0.5 WS-Q5 — Seed Rollback / Compensation Draft

Phase: v0_5_WS_Q5_seed_and_privilege_command_authoring · Nature: authoring_only / no_execution · Date: 2026-05-18 Inverts: seed-data-draft (this package). Doctrine (Q5 master plan §2.5 / QG6): hard delete is NOT the default — prefer deactivate/retire/forward-compensation when data exists or is referenced.

⚠️ GATING BANNER — DO NOT EXECUTE

phase: seed_rollback_authoring
sql_executed: none ; rollback_executed: false ; cascade_used: false   # QG5
execution_authorized: false ; self_advance: PROHIBITED
decision_authority: GPT / User ONLY

---

1. Two-path doctrine (choose by data/reference state at rollback time)

PATH_R-A  clean exact-inverse DELETE — ONLY if ALL preconditions hold:
  - the 8 seeded tables hold EXACTLY the 31 bootstrap rows of seed-data-draft
    (PK set identical; no later non-seed rows added)
  - NO downstream reference exists: entity_reference_registry,
    source_document_registry, source_document_version_registry,
    authority_override all still 0 rows; no IU bound to any seeded key;
    no manifest/cut references a seeded grammar/source_family
  -> blast radius is config-only, rows are KNOWN seed rows -> exact DELETE
     of exactly the seeded PKs is the true safe inverse (zero data loss)
PATH_R-B  lifecycle retire / forward-compensation — if ANY R-A precondition fails
  (data exists or is referenced): DO NOT hard-delete; demote
  lifecycle='deprecated' (append-only audit trail), supersede with
  corrected rows, quarantine, and ESCALATE to GPT/User. Never silent
  UPDATE-in-place of an authority row beyond the lifecycle column.

Precondition probe (read-only; run before choosing path)

-- ALL must return 0 for PATH_R-A eligibility:
SELECT count(*) FROM cutter_governance.entity_reference_registry;
SELECT count(*) FROM cutter_governance.source_document_registry;
SELECT count(*) FROM cutter_governance.source_document_version_registry;
SELECT count(*) FROM cutter_governance.authority_override;
-- and: no row count beyond the authorized seed (verification-plan §1 counts).
-- If any > 0 OR counts != authorized seed -> PATH_R-B, escalate.

2. PATH_R-A — exact-inverse DELETE, reverse FK order, NO CASCADE (DO NOT EXECUTE)

-- Reverse of seed insert_order. Each DELETE targets EXACTLY the seeded PKs.
-- No CASCADE: children deleted before parents so every FK is already clear.
BEGIN;

DELETE FROM cutter_governance.metadata_key_registry
 WHERE metadata_key IN ('idempotency_key');

DELETE FROM cutter_governance.source_family_registry
 WHERE source_family IN ('internal_incomex_constitution','internal_incomex_law','external_government_law');

DELETE FROM cutter_governance.entity_kind_registry
 WHERE entity_kind IN ('sql_entity','code_module','git_file','directus_item','report_path');

DELETE FROM cutter_governance.grammar_profile_status_marker
 WHERE grammar_profile_ref='incomex-architecture-constitution-v4' AND marker IN ('✅','📋');

DELETE FROM cutter_governance.grammar_profile_level
 WHERE (grammar_profile_ref='incomex-architecture-constitution-v4' AND level_seq IN (1,2,3))
    OR (grammar_profile_ref='vn-national-law' AND level_seq IN (1,2,3,4,5));

DELETE FROM cutter_governance.grammar_profile
 WHERE grammar_profile_ref IN ('incomex-architecture-constitution-v4','vn-national-law');

DELETE FROM cutter_governance.address_template_registry
 WHERE address_template_ref IN ('at.icx.const.v4','at.vn.law');

DELETE FROM cutter_governance.matcher_config_registry
 WHERE matcher_ref IN ('mc.icx.nguyen_tac','mc.icx.kien_truc','mc.icx.dieu',
   'mc.vn.chuong','mc.vn.dieu','mc.vn.khoan','mc.vn.diem','mc.vn.doan');

COMMIT;
-- Post: 8 seeded tables back to 0 rows; 12 tables empty as at production apply;
-- schema/constraints/owner UNCHANGED; zero data loss (rows were known seed).

3. PATH_R-B — lifecycle retire / compensation (data exists or referenced; DO NOT EXECUTE)

-- Append-only doctrine: demote, do NOT delete. Only the lifecycle column is
-- touched (no other in-place mutation of an authority row). Child tables
-- without a lifecycle column (grammar_profile_level / status_marker /
-- authority_override) are retired via their PARENT's lifecycle + supersession,
-- never hard-deleted while referenced.
BEGIN;
UPDATE cutter_governance.matcher_config_registry   SET lifecycle='deprecated' WHERE matcher_ref LIKE 'mc.icx.%' OR matcher_ref LIKE 'mc.vn.%';
UPDATE cutter_governance.address_template_registry SET lifecycle='deprecated' WHERE address_template_ref IN ('at.icx.const.v4','at.vn.law');
UPDATE cutter_governance.grammar_profile           SET lifecycle='deprecated' WHERE grammar_profile_ref IN ('incomex-architecture-constitution-v4','vn-national-law');
UPDATE cutter_governance.source_family_registry    SET lifecycle='deprecated' WHERE source_family IN ('internal_incomex_constitution','internal_incomex_law','external_government_law');
UPDATE cutter_governance.entity_kind_registry      SET lifecycle='deprecated' WHERE entity_kind IN ('sql_entity','code_module','git_file','directus_item','report_path');
UPDATE cutter_governance.metadata_key_registry     SET lifecycle='deprecated' WHERE metadata_key IN ('idempotency_key');
COMMIT;
-- Then: supersede with corrected rows in a fresh sovereign-gated seed cycle;
-- quarantine writes on affected keys; ESCALATE to GPT/User. No DELETE.

4. Notes / flags

QG5_safe_for_seed_rows: yes — R-A only on KNOWN seed PKs with zero downstream
  references (probed §1); otherwise R-B retire (no hard delete).
grammar child tables: grammar_profile_level / grammar_profile_status_marker
  have NO lifecycle column -> not independently demotable; under R-B they are
  retired by parent grammar_profile lifecycle=deprecated + supersession.
no CASCADE anywhere (QG5). Every step command-review-gated, never auto-run.
dependency: which path is valid is a RUNTIME determination at the future
  (separately authorized) execution phase, gated on the §1 probe; Agent does
  NOT pre-decide. Escalate any ambiguity (master plan §2.5).

5. Statements

• QG2: nothing executed. QG5/QG6: hard delete only for known unreferenced seed rows (R-A); otherwise lifecycle retire + escalate (R-B); no CASCADE.
• No GRANT, no Directus, no vector, no CUT/VERIFY, no deploy, no git commit, no self-advance.
• Self-advance PROHIBITED — doc 2 of 6; STOP → route GPT/User.

Companion: seed-data-draft, privilege-grant-draft, privilege-rollback-draft, seed-privilege-verification-plan, seed-privilege-authoring-report.