100000x · 07 — Rollback Package

Status: authored, not invoked. Safe to apply at any time if a defect is found post-merge.

Pre-condition checks (operator)

-- 1. No staging row currently consumed by a 040R/041R run_id (would orphan audit linkage)
SELECT count(*) FROM iu_core.iu_staging_record sr
 WHERE sr.consumed_by_run_id IN (
   SELECT run_id FROM public.dot_iu_command_run
    WHERE command_name IN ('dot_iu_cut_from_manifest','dot_iu_verify_cut_result')
 );
-- expect 0; if >0, do NOT roll back (live cut state would be unverifiable)

Rollback 041R first (no dependency cost)

BEGIN;
DELETE FROM public.dot_iu_command_catalog WHERE command_name='dot_iu_verify_cut_result';
DROP FUNCTION IF EXISTS public.fn_iu_verify_cut_result(uuid, text);
COMMIT;

D9 deltas: dot_total -1, public_fns -1. No state to undo (verify writes only audit rows; those rows remain as durable telemetry — acceptable).

Rollback 040R

BEGIN;
DELETE FROM public.dot_iu_command_catalog WHERE command_name='dot_iu_cut_from_manifest';
DROP FUNCTION IF EXISTS public.fn_iu_cut_from_manifest(uuid, boolean, text, text);
COMMIT;

D9 deltas: dot_total -1, public_fns -1.

Combined verification

After both rollbacks:

SELECT
  (SELECT count(*) FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace
    WHERE n.nspname='public' AND proname IN ('fn_iu_cut_from_manifest','fn_iu_verify_cut_result')) AS fns_present,
  (SELECT count(*) FROM dot_iu_command_catalog
    WHERE command_name IN ('dot_iu_cut_from_manifest','dot_iu_verify_cut_result')) AS catalog_present;
-- expect 0 / 0

What rollback does NOT undo

• Smoke-test audit rows in dot_iu_command_run (3 rows from Phase B/C smoke tests). These remain as durable telemetry; safe to retain.
• 037-039 fns / catalog rows (out of scope for 100000x rollback; remain live).
• The iu_staging_record pending_review vocab and tightened CHECKs from 91000x mig 037 (out of scope; use 91000x report 06 rollback if needed).

Test of round-trip (deferred)

If operator wants a round-trip rehearsal: apply rollback → confirm fn_iu_cut_from_manifest missing → re-apply 040R from /tmp/iu100000x/040R-cut-from-manifest.sql → confirm idempotent (catalog INSERT has ON CONFLICT DO NOTHING).

Cross-links

• 91000x report 06 (037-039 rollback package).
• Mission rule: "Backup before mutation" — backups stored at /opt/incomex/backups/100000x/ (pre + post snapshots; see report 06 sha256s).