984 B
Rollback
Every executable plan names a rollback target before execution. The operation captures an immutable snapshot of subject identity/state/version, environment, affected identities and rollback reference. The same pattern can represent deployment, project binding, runtime/config and future index-alias restoration without mutating provenance records.
Rollback is explicit or triggered by canary/restart reconciliation. It restores the exact prior snapshot and records elapsed wall-clock time from rollback start until the prior state is restored; the result is evidence, not an invented SLO. Retrying an already rolled-back operation is idempotent.
If the snapshot/target is unavailable, the operation becomes FAILED with
ROLLBACK_FAILED and the subject becomes MANUAL_INTERVENTION_REQUIRED. ModelForge never reports
stable after incomplete restoration. Startup reconciliation conservatively rolls back operations
left in PREPARING, ACTIVATING or ROLLING_BACK.