Initial public ModelForge release

docs/architecture/ROLLBACK.md

@@ -0,0 +1,16 @@
+# Rollback
+
+Every executable plan names a rollback target before execution. The operation captures an immutable
+snapshot of subject identity/state/version, environment, affected identities and rollback reference.
+The same pattern can represent deployment, project binding, runtime/config and future index-alias
+restoration without mutating provenance records.
+
+Rollback is explicit or triggered by canary/restart reconciliation. It restores the exact prior
+snapshot and records elapsed wall-clock time from rollback start until the prior state is restored;
+the result is evidence, not an invented SLO. Retrying an already rolled-back operation is
+idempotent.
+
+If the snapshot/target is unavailable, the operation becomes `FAILED` with
+`ROLLBACK_FAILED` and the subject becomes `MANUAL_INTERVENTION_REQUIRED`. ModelForge never reports
+stable after incomplete restoration. Startup reconciliation conservatively rolls back operations
+left in `PREPARING`, `ACTIVATING` or `ROLLING_BACK`.