# Rollback

Every executable plan names a rollback target before execution. The operation captures an immutable
snapshot of subject identity/state/version, environment, affected identities and rollback reference.
The same pattern can represent deployment, project binding, runtime/config and future index-alias
restoration without mutating provenance records.

Rollback is explicit or triggered by canary/restart reconciliation. It restores the exact prior
snapshot and records elapsed wall-clock time from rollback start until the prior state is restored;
the result is evidence, not an invented SLO. Retrying an already rolled-back operation is
idempotent.

If the snapshot/target is unavailable, the operation becomes `FAILED` with
`ROLLBACK_FAILED` and the subject becomes `MANUAL_INTERVENTION_REQUIRED`. ModelForge never reports
stable after incomplete restoration. Startup reconciliation conservatively rolls back operations
left in `PREPARING`, `ACTIVATING` or `ROLLING_BACK`.