<a id="week-08-day-03"></a>

#### Day 38 — Make reconciliation and rollback conditional on the state actually observed

**Learning task.** Explain how an otherwise correct candidate becomes unsafe after a concurrent update. The version captured with a scoped read is a precondition, not a timeless property. A real approved transaction must compare the expected version and perform its mutation atomically; checking in a script and writing later leaves a race. If another accepted transaction changes the state, stop and rebuild the reconciliation argument. Do not overwrite the new value simply because an earlier plan was approved.

At the 10:20 planning boundary, C26's snapshot/current/target comparison and C28's isolated pass support a proposed S42 correction. They do not supply the complete current production version or an actual production mutation receipt. Preserve the bounded pre-change state and source version, confirm which business changes must survive, select the owner-approved application path and bind the proposal to that version. If the application cannot enforce the required invariant, return the design to the owner rather than silently using a direct database path that bypasses audit and dependencies.

**Offline laboratory W8-CAS — stale write and stale rollback controls.** Python 3 standard library, pure in-memory records with **invented version 7/8/9**; these are not CTN version observations. This sequential simulator shows conditional state transitions. It does not implement atomicity against a real database, authenticate the Boolean permission or authorize a live correction. Preserve its before-state and predict seven lines:

~~~python
from copy import deepcopy

def cas8(record, expected_version, values, permitted):
    if permitted is not True:
        return "STOP_NO_AUTHORITY", deepcopy(record)
    if record["version"] != expected_version:
        return "STOP_STALE_VERSION", deepcopy(record)
    return "SIM_APPLIED", {"version": expected_version + 1, "values": dict(values)}

before8 = {"version": 7, "values": {"S40": "reserved", "S41": "reserved", "S42": "unavailable"}}
target8 = {**before8["values"], "S42": "open"}
print("W8 NO_AUTH", cas8(before8, 7, target8, False)[0])
print("W8 STALE", cas8({**before8, "version": 8}, 7, target8, True)[0])
status8, applied8 = cas8(before8, 7, target8, True)
print("W8 APPLY", status8, "v" + str(applied8["version"]))
print("W8 preserved slots", ",".join(k for k in ("S40", "S41") if applied8["values"][k] == before8["values"][k]))
status8, reverted8 = cas8(applied8, 8, before8["values"], True)
print("W8 ROLLBACK", status8, "v" + str(reverted8["version"]), "S42=" + reverted8["values"]["S42"])
print("W8 LATE_ROLLBACK", cas8({**applied8, "version": 9}, 8, before8["values"], True)[0])
print("W8 baseline", "v" + str(before8["version"]), "S42=" + before8["values"]["S42"])
~~~

Exact transcript reproduced during publication validation:

~~~text
W8 NO_AUTH STOP_NO_AUTHORITY
W8 STALE STOP_STALE_VERSION
W8 APPLY SIM_APPLIED v8
W8 preserved slots S40,S41
W8 ROLLBACK SIM_APPLIED v9 S42=unavailable
W8 LATE_ROLLBACK STOP_STALE_VERSION
W8 baseline v7 S42=unavailable
~~~

**Worked interpretation.** A successful invented correction preserves S40/S41. A stale request and an unapproved request return unchanged copies. Reversal also needs a version precondition: after another accepted update, replaying an old before-state could destroy later work. The simulator creates a new version on reversal rather than pretending version 7 became current again. Its preserved baseline remains unchanged. However, reversing to that baseline makes S42 unavailable again; rollback is not synonymous with acceptable service. The decision owner must weigh the failed-candidate risk, renewed business harm and permitted next recovery path.

**Contrast and limits.** “The rollback file is intact, so replay it after any error” ignores intervening valid updates, configuration versus business-state differences and irreversible external effects. A corrected design checks source/version, scope, trigger, owner, transaction boundary, relevant audit and post-action service. The toy `cas8` would trust arbitrary supplied values and has no row authorization, real locking, cross-record invariants or event delivery. Its success label verifies only the simulated transition; review those omitted controls before any operational implementation.

**Practice.** Complete [EX038](#exercise-ex038) with §8.3/§8.11's original differences, W8-CAS's transcript, one stale-candidate stop rule and one stale-rollback stop rule. Compare the [worked answer](#answer-ex038). No production correction has occurred at this lesson's checkpoint.

[Previous: Day 37](#week-08-day-02) · [Week 8 index](#week-08-index) · [Course index](../SUBJECTS.md) · [Next: Day 39](#week-08-day-04).

### Exercise for this lesson

<a id="exercise-ex038"></a>
**EX038 — Value-diff fixture.** Objective: preserve valid business changes and reject stale correction or rollback. Inputs: C26/C28, §§8.3/8.11 and Day 38 W8-CAS; no production result yet. Reproduce original differences/mismatch lists and W8-CAS's seven lines. Give the proposed current-version/target/source/authority/transaction/rollback contract and a stop rule for both stale write and stale reversal. Explain why toy version 7/8/9 is not CTN metadata and why a successful reversal can restore an unavailable S42 value. Rubric: 0 = fixture authorizes a live write or stale overwrite; 1 = correct differences but missing concurrency, rollback or environment limit; 2 = exact outputs and a falsifiable owner-governed version/rollback plan preserving S40/S41. [Worked answer](#answer-ex038).

## Worked answers

<a id="answer-ex038"></a>
**EX038 — Model value-diff output.** The in-memory code prints exactly:

```text
08:30 snapshot: S40:open->reserved, S41:open->reserved
10:12 current: S42:unavailable->open
```

Relative to the owner target, the snapshot would regress two authorized slots; current data needs one bounded correction in this three-slot fixture. The code neither reads a production source nor approves a write. Its values must be checked with a real service owner and custodians before any operational decision.

**Additional professional worked reasoning:** The original value-diff has snapshot S40/S41: open->reserved and current S42: unavailable->open. C8X prints the same affected slot sets, without authorizing mutation. A real operation must compare the captured expected S42 version atomically before applying the owner-approved correction and stop on mismatch. An isolated program cannot prove production copy provenance or data completeness.

**Week 8 Day 38 — worked stale-transition controls.** Reproduce §8.3's two full value-diff lines and §8.11's mismatch lists. W8-CAS prints NO_AUTH STOP_NO_AUTHORITY; STALE STOP_STALE_VERSION; APPLY SIM_APPLIED v8; preserved slots S40,S41; ROLLBACK SIM_APPLIED v9 S42=unavailable; LATE_ROLLBACK STOP_STALE_VERSION; baseline v7 S42=unavailable, each under its W8 prefix. Those versions are invented. The simulator leaves rejected records and its baseline unchanged, increments version on reversal and refuses an old rollback after an intervening version. A real contract must authenticate authority and enforce the version/invariant comparison atomically through the approved transaction path, with source receipt and rollback owner. Reversing the test correction restores the old bad S42 state, so it is not service acceptance. The function trusts supplied values and flags and cannot enforce a production business invariant.