Idunn

2026-11-13

Idunn: rollback drift after freezing, cross-binding refusal, and docs

Tests: a previous release that drifts after the rollback was frozen ends
FailedBeforeFencing at the Starting-time verify with current untouched (fails if
that verify is removed); rollback_source refuses a previous release deployed
under another release root or current link. Docs: CommandKind::Rollback needs no
schema change but an Idunn at 9f15cee or earlier cannot decode it (forward-only);
flipped_at ordering and the observed-link check; a rollback cannot be cancelled.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

7ba27c362e

2026-11-13 17:03:48 +00:00

Eureka

Idunn: idunn rollback <target>, a brake-gated transaction flipping to the previous static release

CommandKind::Rollback (command ids rollback-*). The daemon freezes the command
into one transaction built like from_continuity: plan, sealed release and
installed release copied from the transaction that flipped the previous release;
no source, no build, source cleanup SkippedContinuity, no admitted generation.
It reaches the deployment brake and advance_static unchanged. The previous
release is derived from the newest Admitted static flip (control.cc + history.cc)
and the observed link, and refused as a rejected transaction when there is no
completed release, no previous release, current is not the newest flip, the
previous directory is gone, or an artifact digest drifted (new port method
verify_installed, also checked before any flip intent). Rollback counts as a
deploy for the busy and live-per-target checks. CLI: idunn rollback via
parse_up(kind); commit_deployment_command and submit take the kind.

Tests: control_plane::tests::static_rollback_ (7) and parse_rollback (1).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

01b6016193

2026-11-13 16:55:43 +00:00

idunn rollback: flip a static release back to the previous one #3

2026-11-13