07 — Entry==Exit & Rollback Verification

Proof that F-3 mutated nothing persistently: the post-rollback census equals the entry census on every column, confirmed on two independent channels, and the transient rows demonstrably existed inside the transaction (so the ROLLBACK was a real rollback, not a no-op).

7.1 PRE vs POST census (psql channel — ssh contabo, write-capable role)

Metric	PRE (entry)	POST (exit, after ROLLBACK)	Δ
ownership	0	0	0
ruleset	0	0	0
scan_run	0	0	0
cand_state	0	0	0
relations	8	8	0
gov_emit (event_outbox, governance)	0	0	0
sys_issues	198,442	198,442	0
eo_cols (v_object_effective_owner)	9	9	0
inv_rows (inventory seam)	0	0	0
cont_rows (containment seam)	0	0	0
eo_rows (effective owner)	0	0	0
gap_rows	0	0	0
idle_in_tx	—	0	—

Δ = 0 on every column. The two seam views are back to their inert WHERE false form (inv_rows=cont_rows=eo_rows=gap_rows=0). No idle-in-transaction session left behind.

7.2 Transient rows DID exist in-transaction (real rollback, not no-op)

The INTX_TRANSIENT_PERSISTED probe, run just before ROLLBACK:

 ownership | ruleset | scan_run | cand_state
-----------+---------+----------+------------
         2 |       1 |        1 |          1

So inside the transaction the 2 ownership rows (group anchor + direct), the draft ruleset, the scan_run, and the candidate_state all existed and were queried — then vanished on ROLLBACK (POST=0/0/0/0). This proves the ROLLBACK genuinely discarded real writes; the zero-residue result is not because nothing was attempted.

7.3 Independent second-channel confirmation (query_pg, READ ONLY role)

A separate read-only connection, run after the transaction closed, returned identical zeros and additionally:

• pg_get_viewdef('v_governance_object_inventory') = SELECT NULL::text … WHERE false; — the inert definition (the in-txn CREATE OR REPLACE was fully reverted).
• idle_in_tx = 0 (no orphaned session).
• _own_probe leak check: count(*) FROM information_schema.tables WHERE table_name='_own_probe' = 0 — the in-txn probe table did not survive.

Two independent channels agreeing on Δ=0 + inert view defs + no probe leak is the strongest available evidence of zero persistent mutation.

7.4 Out-of-scope invariants held (in-txn probe)

INTX_OUT_OF_SCOPE (mid-transaction, after all activity): relations=8, gov_emit=0, sys_issues=198,442 — unchanged by any F-3 step. No event emitted, no issue persisted, no governance relation altered, even before the rollback.

7.5 No COMMIT occurred

The script contains exactly one terminal transaction statement — ROLLBACK — and no COMMIT anywhere. ON_ERROR_STOP on (outside the negative block) guarantees that any unexpected error would have closed the connection mid-transaction ⇒ implicit ROLLBACK. The transaction completed normally and rolled back explicitly.

7.6 Entry==exit verdict

PASS. Δ=0 across all 12 census columns on two channels; transient rows existed in-txn then disappeared; seams restored inert; no probe leak; idle-tx=0; no COMMIT. Zero persistent mutation proven.