IU Core 7000x — Rollback / Compensation Package

Authored as design + executable scripts; not executed since 7000x produced zero mutations.

Whole-DB safety net (executed)

• file: /tmp/directus-pre-iucore-7000x-20260524T043956Z.dump
• size: 78,877,428 bytes (75.2 MB)
• sha256 (first 12): 2417f2db96b1
• created: 2026-05-24 04:39:56 UTC
• producer: ssh contabo "docker exec -i postgres pg_dump -Fc --no-owner -U directus directus"

DESTRUCTIVE restore (off-hours, read-locked Directus):

ssh contabo "docker cp - postgres:/tmp/restore.dump" < <baseline.dump>
ssh contabo "docker exec -i postgres pg_restore -U directus -d directus --clean --if-exists /tmp/restore.dump"

This overwrites unrelated work since the dump timestamp. Whole-DB only.

Per-IU lifecycle compensation — design stub for next macro

fn_iu_supersede(p_canonical_address text, p_actor text, p_review_decision_id uuid, p_successor_address text, p_reason text):

• enacted → superseded; audit row to iu_lifecycle_log with transition_type='supersede'; canonical-writer marker; fresh review_decision_id required (lifecycle_supersede event_kind); p_successor_address must be enacted IU or null (soft retire).

fn_iu_retire(p_canonical_address text, p_actor text, p_review_decision_id uuid, p_reason text):

• enacted → deprecated (FSM state already recognized: 12 deprecated rows live); audit row transition_type='retire'.

Once implemented, future macros can per-IU compensate.

Qdrant per-actor delete (executable today, logical no-op now)

DELETE FROM public.iu_vector_sync_point
 WHERE last_actor = 'iu_core_7000x_onboarding';

curl -X POST "http://incomex-qdrant:6333/collections/iu_core_iu_chunks/points/delete" \
  -H "Content-Type: application/json" \
  -d '{"filter":{"must":[{"key":"last_actor","match":{"value":"iu_core_7000x_onboarding"}}]}}'

Reversible by re-running 7000x onboarding.

Governance retirement (executable today, logical no-op now)

UPDATE cutter_governance.review_decision
   SET superseded_by_review_decision_id = '<FIX_RD>'
 WHERE review_decision_id = '<NEW_RD>';

UPDATE cutter_governance.manifest_envelope
   SET superseded_by_envelope_id = '<FIX_ENVELOPE>', status='superseded'
 WHERE envelope_id = '<NEW_ENVELOPE>';

Envelope refresh repair

SELECT public.fn_iu_three_axis_envelope_refresh_if_stale(
  p_actor   => 'iu_core_7000x_rollback_refresh',
  p_dry_run => false,
  p_force   => true);

Drift-gated, idempotent, audited.

Non-destructive proof of rollback readiness

Each rollback primitive parameterised by last_actor='iu_core_7000x_onboarding' / <NEW_RD> / <NEW_ENVELOPE> — none exist in DB right now. Running rollback today = DELETE 0 / UPDATE 0 rows.

Conclusion

• Whole-DB rollback: ✅ snapshot exists.
• Per-IU lifecycle compensation: ❌ not implemented (gate-block).
• Qdrant per-actor delete: ✅ executable today.
• Governance per-decision supersede: ✅ executable today.
• Envelope refresh repair: ✅ idempotent wrapper available.

Since 7000x did NOT execute fn_iu_enact, no rollback was needed.