#### Day 30 — Prepare expiry, rollback and the investigation handoff without inventing action **Learning task.** Make a rollback card usable by an authorized successor while distinguishing planned reversal, automatic expiry, renewal and observed restoration. Rollback aims to reverse a specified control change safely; it is not necessarily a restore of business data, an undo of every queued action or proof of recovery. Turning off g-22 could reopen the harmful write path while leaving S42 unavailable. Conversely, leaving a hold active can prolong a legitimate service cost. The service owner and incident lead must weigh these consequences under the applicable procedure; an analyst must not choose an unauthorized extension by omission. At 09:42 the next fixed boundary is 09:47. C17 specifies automatic expiry; there is no actual expiration, rollback or renewal receipt in C13–C19. The proposed card should identify the application operator/rollback role from the approval, the exact S42 control/configuration reference, trigger and decision authority, preservation obligations, expected reversal receipt, protected-state and legitimate-service checks, and the next observer. Keep actual operator, completion time and result fields blank unless an authentic supplied receipt fills them. The card names a required role without inventing a person's name. **Worked trigger comparison.** For expiry without a new approval, honor the recorded automatic-expiry rule and arrange an owner-led exposure/service review; verify what actually happened at the boundary. For an observed alternate-route S42 acceptance, preserve its receipt and urgently re-plan with the owner: removing the partial guard might worsen exposure, while broadening it requires new approval. For unexpected S40/S41 denial or cost beyond accepted tolerance, seek the designated emergency decision and bounded reversal or redesign, retaining audit evidence. A trigger is a reason to invoke the authorized procedure, not a universal “disable all security” instruction. These branches should record both urgency and the unresolved tradeoff. **Contrast.** “Rollback completed at 09:47; service restored” invents two results from a scheduled timer. “Extend for another ten minutes because C16 permitted ten” invents renewal. “Restore the 08:30 snapshot to undo containment” confuses reverting a guard with overwriting business state and could reverse legitimate S40/S41 work. A defensible card instead says “C17 expires at 09:47; actual expiration/reversal and service results pending; seek a separately documented owner decision before any extension.” No later card may fill these fields retrospectively at the 09:42 checkpoint. **Offline tabletop.** Using only paper or a local text editor, clone your 09:42 action record into three explicitly hypothetical branches: expiry/no new approval, verified bypass and legitimate-service regression. For each, write the smallest evidence package to preserve, decision owner, permitted next request, reversal precondition and observation needed afterward. Have a partner reject one branch with a missing owner, one with an expired approval and one claiming S41 availability from S40 alone. The corrected branch must leave execution pending rather than author a signature. No tenant operation or new CTN event is part of the activity. **Worked 09:42 handoff.** “C13 supports S42 version 19 unavailable; C14 excludes q-144 from one complete approved run and C15 finds no official S42 addendum through 09:33. Human actor remains unknown. C17 approves S42-only hold to 09:47, C18 reports g-22 enabled at 09:39, and C19 observes q-147 denied on one application route with q-148/S40 accepted. Other mutation routes and S41 behavior remain unverified. Preserve approval, operator and audit sources; ask the application owner for coverage and accepted-cost review before expiry. Use the designated operator and owner procedure on bypass, service regression or expiry. No rollback, renewal, account disablement or verified cause removal is claimed.” This is a model message built from supplied cards, not a sent communication. **Practice and limits.** Finalize the EX029 rollback card begun on Day 29, then submit [EX030](#exercise-ex030) and compare its [worked answer](#answer-ex030), including the V6 verdict, C6/C6X comparison, W6-MISSING and a 09:42 handoff with the failed/unknown coverage branches. A supervisor should be able to trace every affirmative claim to a card and every future action to a pending gate. Chapter 7 may introduce mechanism and new authority evidence, but its daily sequence is still pending. Do not mark it complete, translate an unreleased unit or treat the Week 6 technical checks as independent human approval. [Previous: Day 29](#week-06-day-04) · [Week 6 index](#week-06-index) · [Course index](../SUBJECTS.md) · [Next: Week 7, Day 31](#week-07-day-01). ### Exercise for this lesson **EX030 — V6 coverage review.** Objective: defend a coverage verdict and bounded handoff. Inputs: isolated V6, C6/C6X, W6-MISSING and Days 29–30. Give a two-sentence V6 verdict, owner design question and retest contract; reproduce C6/C6X outputs, distinguish their declared inventories from CTN evidence, and explain the unobserved third-route control. Add a 09:42 CTN handoff naming scope, cost questions, 09:47 expiry and pending owner decision. No fixture API outcome, S41 result, renewal or cause removal may be imported into CTN. Rubric: 0 = invented CTN bypass/action or global pass; 1 = correct V6 failure but incomplete service/inventory or handoff limits; 2 = exact outputs, scope-qualified verdicts and an auditable pending-action handoff. [Worked answer](#answer-ex030). ## Worked answers **EX030 — Model V6 verdict.** “The isolated V6 guard fails the **all-route** S42 containment criterion: browser-form writes are denied, but a direct API write is accepted; S40 succeeding shows the service is not globally blocked. Ask the application owner whether both routes share the guard predicate, then repeat positive S40 and negative S42 tests through each authorized path after a reviewed design change.” This is a training-tenant outcome. CTN's C19 still documents only its own observed route and should not inherit V6's bypass as an incident fact. **Additional professional worked reasoning:** V6's form write denial with a direct API acceptance is a *negative isolated all-route test*, even if S40 passes. It does not prove CTN's C19 guard failed; C19 observed only one route. Require a corrected route inventory, separate service-owner approval of the design, one labeled positive S40/S41 test and one negative S42 test **per in-scope route**, authoritative state snapshots, request/audit pointers and a failure-triggered rollback. The C6X BYPASS result gives the same logical lesson using separate invented rows, not a second incident card. **C6 containment-state extension — worked laboratory result.** ~~~text C6 09:35 proposal; all-routes=unknown C6 09:37 authorized; all-routes=unknown C6 09:39 reported-enabled; all-routes=unknown C6 09:42 observed-one-route; all-routes=unknown C6 V6 all-route= FAIL ~~~ At 09:35 there is a proposal only; at 09:37 approval; at 09:39 reported enablement; at 09:42 observation on one route. The three-route count inside the fixture is a teaching placeholder, not CTN's known route inventory. The separate V6 variant fails because its API path accepts an S42 write; that result cannot be reported as a CTN incident observation. An EX030 answer must distinguish these scopes. **Week 6 Day 30 — worked coverage and handoff.** V6 fails its all-route S42 property because form denial coexists with API acceptance; its S40 success does not offset the bypass. Ask whether routes share the guard predicate and require authorized isolated per-route protected/legitimate tests, state/audit receipts and stop rules after a reviewed design. C6X's seven exact results are PROPOSED_ONLY, APPROVED_NOT_APPLIED, COVERAGE_UNKNOWN, COVERAGE_UNKNOWN, PROTECTION_FAIL, BUSINESS_FAIL and BOUNDED_TEST_PASS in printed row order. Its two-route and single legitimate-outcome assumptions omit expiry, authentication and per-slot coverage; its pass is a toy consistency result. W6-MISSING's third unobserved route prevents an all-route verdict, and an invented third-route acceptance fails protection in that worksheet only. The Day 30 model handoff correctly names C13–C15's state/approval bounds, C17 expiry, C18 report, C19 one-route denial/S40 success, unverified routes/S41 and pending owner review. It claims no rollback, renewal, account disablement, CTN API bypass or cause removal. Award full credit only when both protection and service gates and the fixed 09:47 boundary survive the handoff.