Lesson 178: Carved-Back Deficiency Quorum Timer and Evidence Rebind Workflow (2026)

Why this matters now

Lesson 172 gave you a mechanical path from mock-audit failure to carved_out deficiencies tied to signed carve-out annex rows from Lesson 163. That path works when the exception is real, bounded, and documented.

It breaks in 2027 the way partners are already writing it into Q1 intake checklists:

• A deficiency carved during the Q3 2026 Gamescom-adjacent window gets reopened because a new reviewer replays the January 2027 first-window tabletop against a different cert_window_id.
• The ticket status flips from carved_out to open in the database without a quorum log, without rebinding evidence manifests, and without invalidating the carve-out annex hash that Lesson 171 still thinks is authoritative.
• The publish pipeline shows green on tuple hashes while the partner annex still references the old window's deficiency summary — the exact failure mode the rollup mismatch help workflow was written for, but applied to carve-back instead of numeric drift.

This lesson installs the carve-back lane: nothing leaves carved_out without quorum, timer discipline, and evidence rebind to the active cert_window_id.

Lesson objectives

By the end of this lesson you will have:

• Extended mock_audit_deficiency_ticket.status with carved_back_pending and carved_back_open states plus invariants that forbid silent carved_out → open updates.
• A deficiency_carve_back_request table capturing who initiated carve-back, why, target cert_window_id, and quorum deadline.
• A carve_back_quorum_vote append-only log with role-separated voters (engineering, governance owner, partner-liaison voice) and SHA-256 snapshot of the ticket row at vote time.
• An evidence_rebind_manifest JSON artifact listing every file hash that must move from from_cert_window_id to to_cert_window_id.
• A wall-clock timer that auto-expires pending requests and pages Lesson 174 on-call routes when quorum misses SLA.

Prerequisites

• Lesson 172 — mock_audit_deficiency_ticket creation and mock_audit_open_deficiency publish gate.
• Lesson 163 — carve-out annex signer discipline (carve-back must reference the original freeze_bypass_id / annex row).
• Lesson 171 — publish pipeline must refuse promotion while carved_back_pending exists on any ticket for the active window.
• Lesson 174 — backup-owner routing for timer breaches.
• Lesson 177 — dictionary stability while rebind manifests reference metric IDs.

Status machine (no silent reopen)

ALTER TABLE mock_audit_deficiency_ticket
  DROP CONSTRAINT IF EXISTS mock_audit_deficiency_ticket_status_check;

ALTER TABLE mock_audit_deficiency_ticket
  ADD CONSTRAINT mock_audit_deficiency_ticket_status_check
  CHECK (status IN (
    'open',
    'resolved',
    'carved_out',
    'carved_back_pending',
    'carved_back_open'
  ));

Allowed transitions:

Database trigger (sketch):

CREATE OR REPLACE FUNCTION forbid_silent_carve_back()
RETURNS TRIGGER AS $$
BEGIN
  IF OLD.status = 'carved_out' AND NEW.status = 'open' THEN
    RAISE EXCEPTION 'carve_back_required: use carved_back_pending lane';
  END IF;
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

deficiency_carve_back_request

CREATE TABLE deficiency_carve_back_request (
  carve_back_request_id   TEXT PRIMARY KEY,
  deficiency_ticket_id    TEXT NOT NULL
                          REFERENCES mock_audit_deficiency_ticket(deficiency_ticket_id),
  from_cert_window_id     TEXT NOT NULL,
  to_cert_window_id       TEXT NOT NULL,
  initiated_by            TEXT NOT NULL,
  initiated_at_utc        TIMESTAMPTZ NOT NULL,
  reason_code             TEXT NOT NULL
                          CHECK (reason_code IN (
                            'new_reviewer_replay',
                            'scope_expansion',
                            'annex_hash_invalidated',
                            'partner_intake_checklist'
                          )),
  reason_narrative        TEXT NOT NULL,
  quorum_required_votes   INTEGER NOT NULL DEFAULT 3,
  quorum_deadline_utc     TIMESTAMPTZ NOT NULL,
  status                  TEXT NOT NULL
                          CHECK (status IN (
                            'pending_quorum',
                            'approved',
                            'expired',
                            'withdrawn'
                          )),
  original_annex_row_id   TEXT NOT NULL,
  evidence_rebind_sha256  TEXT
);

Timer defaults (2026 field practice):

Inside T-3, carve-back is discouraged — prefer resolving under the old window or filing a new deficiency instead of reopening a carved one. If you must carve-back inside T-3, the third quorum voter must be the partner-liaison role, not a second engineer.

carve_back_quorum_vote (append-only)

CREATE TABLE carve_back_quorum_vote (
  vote_id                 TEXT PRIMARY KEY,
  carve_back_request_id   TEXT NOT NULL
                          REFERENCES deficiency_carve_back_request(carve_back_request_id),
  voter_user_id           TEXT NOT NULL,
  voter_role              TEXT NOT NULL
                          CHECK (voter_role IN (
                            'engineering',
                            'governance_owner',
                            'partner_liaison'
                          )),
  vote                    TEXT NOT NULL CHECK (vote IN ('approve','reject')),
  voted_at_utc            TIMESTAMPTZ NOT NULL,
  ticket_snapshot_sha256  CHAR(64) NOT NULL,
  UNIQUE (carve_back_request_id, voter_user_id)
);

Quorum rule: at least one approve from each of the three roles, zero rejects from governance_owner. Engineering may abstain only if partner_liaison approves with written reason_narrative referencing the intake checklist row.

Export votes nightly to release-evidence/<cert_window_id>/carve_back_quorum.ndjson — partners in Q1 2027 increasingly ask for the file by name.

Evidence rebind manifest

When quorum approves, generate evidence_rebind_manifest.json:

{
  "carve_back_request_id": "cbr-2027-q1-window-3-def-0042",
  "from_cert_window_id": "cert-2026-q3-gamescom-adjacent",
  "to_cert_window_id": "cert-2027-q1-first-window",
  "files": [
    {
      "path": "mock_audit_packets/q3-2026-window-1/T-14-rehearsal/manifest.json",
      "sha256_before": "a1b2…",
      "sha256_after": "c3d4…",
      "rebind_action": "copy_with_window_label_rewrite"
    }
  ],
  "tuple_hashes": {
    "publish_tuple_hash": "…",
    "source_tuple_hash": "…"
  },
  "dictionary_semver_pinned": "2.4.1",
  "footer_schema_semver_pinned": "1.3.0"
}

Store evidence_rebind_sha256 on the request row. Lesson 175 archive pointers for the old window stay immutable — rebind creates new archive rows under to_cert_window_id, never mutates WORM objects.

Publish-gate coupling (Lesson 171)

Extend the open-deficiency query from Lesson 172:

SELECT COUNT(*) AS blocking_rows
FROM mock_audit_deficiency_ticket
WHERE cert_window_id = :active_cert_window_id
  AND status IN ('open', 'carved_back_pending', 'carved_back_open');

Any carved_back_pending row blocks publish with block_reason = 'mock_audit_carve_back_pending' distinct from mock_audit_open_deficiency so on-call knows which playbook to run.

Six-step carve-back procedure

1. File request — engineering opens deficiency_carve_back_request, sets ticket to carved_back_pending, pins original_annex_row_id.
2. Notify quorum — page three roles; attach link to frozen ticket PDF from Lesson 172 tabletop.
3. Collect votes — 48–72h window; scribe exports carve_back_quorum.ndjson even if incomplete (incomplete = evidence of failure).
4. Rebind evidence — run manifest generator; verify every sha256_after on disk; commit manifest under release-evidence/.
5. Signer ack — governance owner ack on Lesson 174 route; flip ticket to carved_back_open.
6. Re-run mock tabletop slice — score only the reopened dimension; append new mock_audit_log row — do not edit the old log (immutable).

Common mistakes

• Silent SQL update carved_out → open to "unblock" Friday publish — triggers partner intake failure in Q1 2027 when quorum log is missing.
• Reusing old manifest paths without rewriting cert_window_id labels — tuple hashes match while human readers see the wrong window name.
• Letting one person hold all three quorum roles — defeats the checklist; use distinct humans or defer carve-back.
• Mutating WORM archive rows from Lesson 175 instead of appending new pointers.
• Skipping partner-liaison vote inside T-3 — automatic yellow on intake replay.

Verification checklist

• [ ] Trigger forbid_silent_carve_back rejects direct carved_out → open in staging.
• [ ] Publish gate blocks on carved_back_pending with distinct block_reason.
• [ ] One end-to-end carve-back drill produces carve_back_quorum.ndjson + evidence_rebind_manifest.json under release-evidence/.
• [ ] Expired quorum returns ticket to carved_out without orphan pending rows.
• [ ] Lesson 170 FAQ export includes carve-back count for the active window.

Mini exercise (90 minutes)

In staging, carve out a synthetic deficiency, then initiate carve-back to a new cert_window_id with a deliberate missing partner-liaison vote. Watch timer expiry restore carved_out. Repeat with full quorum and verify publish gate blocks only during carved_back_pending, not after proper carved_back_open + remediation plan filed.

Troubleshooting

Pro tips

• Tip — Quorum template: keep a one-page Notion/Google Doc with the three named voters pre-filled each cert season.
• Tip — Timer visibility: show quorum_deadline_utc on the same dashboard tile as Lesson 174 heat-map reds.
• Tip — Pair with Lesson 173: if the same failure_mode_tag keeps getting carved back, the trend board should go hot, not carved_out again.

Next lesson teaser

The next lesson (Lesson 179: Multi-Region Reviewer Feedback Ingestion US/EU/Asia Handoff Weeks (2026)) covers follow-the-sun cert desks — ingesting reviewer comments across US/EU/Asia business days without tuple lag. Lesson 178 keeps carve-backs honest inside one org; Lesson 179 keeps handoffs from looking like healthy silence when the US desk is asleep.

Continuity

• Paired Unity guide chapter (next Guide-Create pass): Unity 6.6 LTS OpenXR governance carve-back quorum timer preflight — ScriptableObject quorum policy + editor window that exports carve_back_quorum.ndjson.
• Help article: OpenXR Governance Partner SLA Snapshot vs Leadership Dashboard Rollup Mismatch (Quest) Fix — still first triage when annex totals disagree after rebind.
• Lesson 177 — dictionary semver pinned in rebind manifest must match active migration phase.
• Lesson 176 — outbound reply packets attach quorum NDJSON as annex evidence.
• Lesson 175 — append-only archive; rebind never mutates cold storage.
• Lesson 174 — timer breach pages backup owner routes.
• Lesson 173 — recurring carve-backs elevate trend-board classification.
• Lesson 172 — source deficiency tickets and mock audit immutability.
• Lesson 171 — extended publish-gate block_reason values.
• Lesson 170 — FAQ export lists carve-back counts per window.
• Lesson 163 — original carve-out annex row referenced by original_annex_row_id.

FAQ

Can we carve back without a new cert window?
Only if from_cert_window_id equals to_cert_window_id and reason_code = 'annex_hash_invalidated'. Otherwise you are reopening under a new window label — pick a real to_cert_window_id.

Does carve-back delete the carve-out annex?
No. The annex remains in the audit trail; carve-back adds quorum + rebind evidence on top.

How many carve-backs per window before partners push back?
Field guidance in 2026 intake templates: more than two carve-backs per window triggers explicit partner question — treat as signal to fix systemic issues via Lesson 173, not more carve-outs.

Carve-back without quorum is how teams lose 2027 first-window intake on a technicality while the build was fine. Timers, votes, and rebind manifests are boring on purpose — boring is what partners can audit.