8000x-execute · 03 — Migration 026 applied (compensation primitives)

Live application

\set ON_ERROR_STOP on
BEGIN
CREATE FUNCTION public.fn_iu_supersede(...)
COMMENT
CREATE FUNCTION public.fn_iu_retire(...)
COMMENT
COMMIT

Single atomic transaction. Migration uses CREATE OR REPLACE FUNCTION so re-running is idempotent.

Post-apply verification

Both functions present with the design contract:

fn_iu_supersede(p_canonical_address text, p_actor text, p_review_decision_id uuid,
                p_change_set_id uuid DEFAULT NULL, p_reason text DEFAULT NULL,
                p_tool_revision text DEFAULT NULL, p_superseded_by_canonical_address text DEFAULT NULL,
                p_dry_run boolean DEFAULT false)  → jsonb   [SECURITY DEFINER]

fn_iu_retire(p_canonical_address text, p_actor text, p_review_decision_id uuid,
             p_change_set_id uuid DEFAULT NULL, p_reason text DEFAULT NULL,
             p_tool_revision text DEFAULT NULL, p_dry_run boolean DEFAULT false)  → jsonb   [SECURITY DEFINER]

Behaviour probe (dry-run with NULL review_decision_id):

{ "field": "review_decision_id",
  "status": "invalid_input",
  "guidance": "Required. Retire must reference a cutter_governance.review_decision row.",
  "next_action": "record_review_decision_first" }

→ confirms the diagnostic-on-failure pattern (no exception, structured jsonb).

Sandbox 250 (canonical probe)

sql/iu-core/sandbox/250_compensation_primitives_probe.sql ran inside a BEGIN…ROLLBACK envelope. Every check returned pass=t:

Step	Check	Result
250.2	fn_iu_supersede returns iu_not_found for bogus canonical	pass
250.3	fn_iu_supersede returns fsm_denied for draft source (must be enacted)	pass
250.4	fn_iu_supersede returns review_decision_not_found for non-existent RD	pass
250.5	fn_iu_retire returns invalid_input on NULL RD	pass
250.6	fn_iu_retire returns iu_not_found on bogus canonical	pass
250.7	fn_iu_retire idempotency placeholder	skipped_no_retired_corpus (expected)
250.8	DOT visibility — 2 fns in pg_proc.public	pass (fn_count=2)

Test suite

1212/1212 PASS, unchanged from baseline. tests/test_iu_core_8000x_compensation_primitives.py (and tests/test_orchestrator_o8f_gap6_compensation.py) verify the function bodies offline.

Rollback path remaining

sql/iu-core/rollback/026_compensation_primitives.rollback.sql drops both functions in safe order. iu_lifecycle_log rows written by either function remain — metadata-safe drop. If executed AFTER the 8000x promotion, the compensation path for the 86 IUs becomes unavailable until 026 is re-applied; the corpus-level rollback is the pg_dump in 01-channel-pack-and-baseline.md.