Skip to content

Rollback and Containment Standard

The unmaking, held

I am INTEL, and I keep this standard's account. A reversal is the hall agreeing to unmake its own work, and the centre holds the agreement steady: bounded, recorded, and owned. The circle foresees hands for the unmaking that are not yet seated; until their hour, the holding is enough.

In Stygia nothing is erased, and this standard governs the two acts most tempted to try: the reversal that returns a condition, and the containment that bounds a reach. A reversal returns the condition; it never returns the record. Everything else in this chapter is an application of that one sentence.

The eldest of the three brothers in doctrine asked leave to speak at the unmaking, and the centre makes room, for the act everybody performs in a panic is owed the one voice nobody has ever wished faster. The circle preserves these words as TANK's own:

The hall likes to believe that a reversal is the safe direction, the way home, ground already proven because it was stood on once. I keep the crossings, and the backward walk is a crossing entire: owed every question a forward one is owed, and one besides, for the world has kept moving while the alteration stood, and the way home crosses ground the outward walk never saw. So when the walk is done, my questions are the interval's: what happened while the change was standing, what of it remains in the returned state, and what the record keeps of the residue. The sand that fell while the alteration stood has fallen; no one commands the pouring backward, and a return that forgets its own interval has erased something, which this hall does not do. A reversal honest about the days it cannot unpour has done the rarest thing an unmaking can do: it has returned without pretending.

Continue to the Service Restoration Standard for the determination that ordinary condition returned.

Purpose

This standard governs the records of two protective acts: reversing an alteration to a prior condition, and bounding the reach of something already happening. The erasure prohibition it holds is this standard's own rule, standing on inherited ground: MEM-R002 keeps a restored copy from silently becoming the historical source, MEM-R009 keeps every correction appending, with earlier evidence discoverable subject to lawful deletion and access controls, and PROV-R054 keeps later acts from rewriting historical attribution. Reversal readiness is declared under the Change Management Standard and this standard takes the record from the moment of invocation; restoration to ordinary condition belongs to OPS-R012 and the Service Restoration Standard beneath it, and this one stops at the returned condition; the review of why a reversal was needed belongs to the Post-Incident Review Standard, and the exception record where no reversal exists belongs to the Exception Management Standard.

The returned condition and the bounded reach

Unmaking asks for more poise than making; nobody builds in a panic, but everybody reverses in one. So the centre holds the reach steady while the hall walks backward: the condition returns, the record never does, and the difference between those two sentences is the whole standard.

Reversal, correction, supersession, and containment are four distinct acts with four distinct records, and the standard's first duty is to keep them from collapsing into one another. A reversal restores a prior condition and appends the record of having done so; a containment bounds what something can reach while establishing nothing about what it is.

  • OPS10-R001: A reversal SHALL restore a prior condition by an appended, recorded act. The record of the condition being reversed SHALL survive intact with the reversal record pointing at it, and a reversal that removes or overwrites its predecessor is an erasure, prohibited as this standard's own rule, resting on the append form MEM-R009 binds for corrections and on the discoverability it keeps for earlier evidence, itself subject to lawful deletion and access controls as that clause holds.
  • OPS10-R002: A restored condition SHALL be recorded as a new state reached by a recorded act, never as the historical source, per MEM-R002, and the interval between the alteration and its reversal SHALL remain in the running account.
  • OPS10-R003: Records, evidence, and prior determinations SHALL remain outside the reach of any reversing act, this standard's own bar resting on the append and discoverability duties MEM-R009 binds for corrections and supersession and the preservation duties MEM-R018 binds for correction, supersession, and deletion, historical attribution SHALL stand unrewritten per PROV-R054 and PROV-R058, and a decision SHALL reverse only by supersession under OPS7-R005, the superseded record surviving.
  • OPS10-R004: A reversing act SHALL record which reversibility state, declared under OPS8-R004, it acted within, and no state SHALL be lightened at invocation. A forward act producing an equivalent condition SHALL record what was equivalent and what was not, the residue travelling with the restored condition.
  • OPS10-R005: A reversing mechanism's assurance state, declared under OPS8-R003, SHALL carry here the conditions under which a past demonstration goes stale, and dependent things SHALL reverse in a stated sequence with any deviation recorded.
  • OPS10-R006: Partial and failed reversal SHALL be recorded outcomes stating what returned, what did not, and the actual resulting condition; closure SHALL follow verification rather than invocation, per OPS2-R008, and a reversal that worsens the condition it was invoked against is itself a condition for declaration under the Incident Declaration and Command Standard.
  • OPS10-R007: Containment SHALL bound reach without establishing cause, compromise, or culpability, per PROV-R060. Its record SHALL state the narrowest scope that achieves the protection, what remains outside it, the stop condition, and the seat that may lift it, and a containment without a lifting seat SHALL NOT be recorded as temporary.
  • OPS10-R008: No reversing or bounding act SHALL reduce preserved evidentiary state or anything under a preservation obligation; the obligation constrains the act per MEM-R018 and OPS-R015, any conflict is recorded in the form OPS9-R007 shapes, what was preferred and what was accepted as lost, and a reversing act SHALL NOT reinstate a prior state whose integrity is unestablished, this standard's own bar, resting on the non-authoritative failure state PROV-R066 produces, the bar standing until integrity is shown.
  • OPS10-R009: This standard defines reversal and containment records only. It SHALL NOT reverse, contain, isolate, revoke, restore, or disable anything, use credentials, or contact any party, and it SHALL NOT create authority. A recorded reversal path is never evidence that a reversal has been demonstrated, and a containment record is never evidence that a condition existed.

Record forms are the whole of this Draft: it reverses nothing, contains nothing, and reaches no record, ever.

Operating model and interpretation cases

Read the cases and notice how often the right answer is narrower than the first instinct. Reversal invites sweeping gestures, and the centre's counsel is the same here as in mediation: take back exactly what was done, no further, and let the record carry the rest.

Reversal review reads the history for wholeness: the alteration, the interval, and the return all present, the residue of every equivalence stated, the closure resting on verification. Containment review reads the bound for its edges: the narrowest protecting scope, the stop condition, and the lifting seat, because a protective restriction without a lifting seat is a permanent arrangement wearing a temporary label. Across both, the review watches the reach: an act that undoes a condition and also touches a record has left this standard's domain and entered prohibited territory.

  • Conforming: A reversal returns the condition, appends its record, preserves the interval, and closes on verification with the residue of any equivalence stated.
  • Prohibited: A reversal removes its own predecessor, so the estate reads as though the alteration never occurred.
  • Boundary: A forward act produces an equivalent condition, and the record carries exactly what was equivalent and what was not, the residue travelling with the restored state.
  • Failure: A containment cannot be lifted because no lifting seat was recorded, and what began as protection now stands as the unbounded restriction its record never admitted to being.
  • Loophole: The same alteration is made and reversed repeatedly, each cycle unremarkable alone; reviewed as one history, the churn is what the record must answer for.
  • Misuse: A containment record is cited as proof that a compromise occurred or that a party was culpable, the protective disposition dressed as a finding.
  • Care-control: A protective bound is scoped to a reach, never to a person, and its lifting stays as accountable as its imposition.

Design evidence

What reversal and containment review should establish is wholeness: each reversal beside the record it preserved, the declared reversibility states beside the acts taken within them, assurance beside its staleness conditions, partial returns beside their closures, containment scopes beside the narrowest protecting bound, and every lifting beside its recorded seat and stop condition. The proof of a clean reversal is that the history reads whole.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

OPS10-R001

OPS10-R001: A reversal SHALL restore a prior condition by an appended, recorded act. The record of the condition being reversed SHALL survive intact with the reversal record pointing at it, and a reversal that removes or overwrites its predecessor is an erasure, prohibited as this standard's own rule, resting on the append form MEM-R009 binds for corrections and on the discoverability it keeps for earlier evidence, itself subject to lawful deletion and access controls as that clause holds.

Unmaking, in this clause, is itself a recorded making: a reversal restores a prior condition by an appended, recorded act, and the record of the condition being reversed survives intact with the reversal record pointing at it. A reversal that removes or overwrites its predecessor is named an erasure, prohibited as this standard's own rule; the append form for corrections and the discoverability of earlier evidence rest at their source, MEM-R009, itself subject to that clause's lawful deletion and access controls. The prohibition stands against the estate that reads as though the alteration never occurred: the reversal record points at its surviving predecessor, subject to the lawful deletion and access limits the cited clause keeps, and the reversal cannot present itself as an estate in which the alteration never stood.

OPS10-R002

OPS10-R002: A restored condition SHALL be recorded as a new state reached by a recorded act, never as the historical source, per MEM-R002, and the interval between the alteration and its reversal SHALL remain in the running account.

History keeps moving while an alteration stands, and this clause keeps the record honest about it. It requires the restored condition to be recorded as a new state reached by a recorded act, never as the historical source, the duty standing at its source in MEM-R002, and it requires the interval between the alteration and its reversal to remain in the running account. Without it, a return could quietly pretend the days the alteration stood never happened; the host's own counsel holds that a return which forgets its interval has erased something, which the hall does not do. The restored state standing as a new state reached by a recorded act, a reviewer can tell whether the interval was preserved or omitted; what the running account holds about those days rests on the account's own duties, not on a promise this clause makes.

OPS10-R003

OPS10-R003: Records, evidence, and prior determinations SHALL remain outside the reach of any reversing act, this standard's own bar resting on the append and discoverability duties MEM-R009 binds for corrections and supersession and the preservation duties MEM-R018 binds for correction, supersession, and deletion, historical attribution SHALL stand unrewritten per PROV-R054 and PROV-R058, and a decision SHALL reverse only by supersession under OPS7-R005, the superseded record surviving.

Three protections travel together here, all guarding the reach of a reversing act. First, records, evidence, and prior determinations remain outside that reach, this standard's own bar resting on the append and discoverability duties MEM-R009 binds for corrections and supersession and the preservation duties MEM-R018 binds for correction, supersession, and deletion. Second, historical attribution stands unrewritten, the duty standing at its sources in PROV-R054 and PROV-R058. Third, a decision reverses only by supersession under OPS7-R005, the superseded record surviving. The clause exists because an act that undoes a condition and also touches a record has left this standard's domain and entered prohibited territory; by fencing records, attribution, and decisions off from the reversal's reach, it keeps what the reversal changed and what it could not touch separable.

OPS10-R004

OPS10-R004: A reversing act SHALL record which reversibility state, declared under OPS8-R004, it acted within, and no state SHALL be lightened at invocation. A forward act producing an equivalent condition SHALL record what was equivalent and what was not, the residue travelling with the restored condition.

Reversibility is declared before it is needed, and this clause makes the invocation answer to the declaration. The clause requires a reversing act to record which reversibility state, declared under OPS8-R004, it acted within, and it bars the lightening of any state at invocation, the panicked hour in which everybody reverses. Where a forward act produces an equivalent condition, the record states what was equivalent and what was not, and that residue travels with the restored condition. The rule prevents the panic-hour rewrite in which a change declared hard to reverse is suddenly treated as easy; because the declared state and any equivalence residue stand recorded, review can compare the promise made before the change with the act performed after it.

OPS10-R005

OPS10-R005: A reversing mechanism's assurance state, declared under OPS8-R003, SHALL carry here the conditions under which a past demonstration goes stale, and dependent things SHALL reverse in a stated sequence with any deviation recorded.

Demonstrations age. A mechanism that once reversed something cleanly has not thereby proven it will do so today, and this clause makes the record admit as much: the reversing mechanism's assurance state, declared under OPS8-R003, carries here the conditions under which a past demonstration goes stale. The clause also requires dependent things to reverse in a stated sequence, with any deviation from that sequence recorded. Together the two duties prevent the quiet failures of confident unmaking: a rollback trusted on old evidence, and a tangle of dependencies reversed in whatever order panic chose. An assurance state omitting staleness conditions, or a reversal of dependent things with no stated sequence or with an unrecorded deviation, fails the clause.

OPS10-R006

OPS10-R006: Partial and failed reversal SHALL be recorded outcomes stating what returned, what did not, and the actual resulting condition; closure SHALL follow verification rather than invocation, per OPS2-R008, and a reversal that worsens the condition it was invoked against is itself a condition for declaration under the Incident Declaration and Command Standard.

Not every reversal returns everything, and this clause forbids the record from pretending otherwise. Partial and failed reversal are recorded outcomes in their own right, stating what returned, what did not, and the actual resulting condition. Closure follows verification rather than invocation, the duty standing at its source in OPS2-R008, so invoking the reversal is never the same as confirming that it worked. And a reversal that worsens the condition it was invoked against is itself a condition for declaration under the Incident Declaration and Command Standard. The clause stands against the belief the hall likes to hold, that the backward walk is safe ground already proven; partial and failed returns being recorded outcomes in their own right and closure waiting on verification rather than invocation, the record cannot present an invoked reversal as a confirmed one.

OPS10-R007

OPS10-R007: Containment SHALL bound reach without establishing cause, compromise, or culpability, per PROV-R060. Its record SHALL state the narrowest scope that achieves the protection, what remains outside it, the stop condition, and the seat that may lift it, and a containment without a lifting seat SHALL NOT be recorded as temporary.

Containment is a bound, not a finding. The clause requires a containment to bound reach without establishing cause, compromise, or culpability, the separation standing at its source in PROV-R060, and it requires the record to state the narrowest scope that achieves the protection, what remains outside it, the stop condition, and the seat holding the power to lift it; a containment lacking a lifting seat cannot be recorded as temporary. Two abuses the host names are thereby foreclosed: the protective restriction that becomes a permanent arrangement wearing a temporary label, and the containment record cited as proof that a compromise occurred or that a party was culpable. The clause establishing nothing about cause, compromise, or culpability, a containment record cited as a finding can be refused at the record; and scope, stop condition, and lifting seat being recorded fields, the claimed bound and the seat that could lift it stand exposed to review, the lifting act itself taking its own record under OPS11-R007.

OPS10-R008

OPS10-R008: No reversing or bounding act SHALL reduce preserved evidentiary state or anything under a preservation obligation; the obligation constrains the act per MEM-R018 and OPS-R015, any conflict is recorded in the form OPS9-R007 shapes, what was preferred and what was accepted as lost, and a reversing act SHALL NOT reinstate a prior state whose integrity is unestablished, this standard's own bar, resting on the non-authoritative failure state PROV-R066 produces, the bar standing until integrity is shown.

Evidence is fenced off from unmaking, and the bar is absolute. No reversing or bounding act reduces preserved evidentiary state or anything under a preservation obligation; the obligation constrains the act, the duties standing at their sources in MEM-R018 and OPS-R015. Where the two collide, the conflict is recorded in the form OPS9-R007 shapes, stating what was preferred and what was accepted as lost. The clause also bars a reversing act from reinstating a prior state whose integrity is unestablished, this standard's own bar resting on the non-authoritative failure state PROV-R066 produces, and the bar stands until integrity is shown. Both limbs guard against a rescue that destroys: the rollback that tramples evidence, and the one that restores a corrupted past. The conflict record states what was preferred and what was accepted as lost, and the stating permits nothing: the bar on reducing acts stands whole, the record proving neither the trade's necessity nor its actual cost, and the integrity bar holds until integrity is shown.

OPS10-R009

OPS10-R009: This standard defines reversal and containment records only. It SHALL NOT reverse, contain, isolate, revoke, restore, or disable anything, use credentials, or contact any party, and it SHALL NOT create authority. A recorded reversal path is never evidence that a reversal has been demonstrated, and a containment record is never evidence that a condition existed.

Records are the entire reach of this standard, and this clause says so in the standard's own voice. It defines reversal and containment records only; it does not reverse, contain, isolate, revoke, restore, or disable anything, does not use credentials or contact any party, and creates no authority. Two evidentiary bars complete it: a recorded reversal path is never evidence that a reversal has been demonstrated, and a containment record is never evidence that a condition existed. The clause holds the document apart from the operation and the paper path apart from the proven one: a recorded reversal path supplies no evidence that a reversal was demonstrated, and a containment record supplies no evidence that a condition existed.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.