I0917 — A bad deployment can be undone deterministically

BLOCKED wave 5 · p1 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Objective

Record the deployed image reference before changing production and provide a rollback that rests on what the provider actually supports, so that a failed smoke run has an exit.

Why

Autostop and a single machine mean a bad image is the only image. Knowing the previous reference before the change is what makes recovery a command instead of an investigation.

Current state

Nothing is deployed and nothing records what was deployed before.

Desired state

The previous image reference is captured before every deploy, a failed smoke run reports both references safely, and one documented command returns production to the previous image.

Scope

• apps/majordomus-cli/src/deploy/rollback.rs

Out of scope

• Inventing a provider command that does not exist
• Automatic rollback that has never been executed successfully in a test

Dependencies

• I0914BLOCKED One deployment core, one command, and a dry run that mutates nothing

What waits on this

• I0931BLOCKED The application exists, one machine runs it, and the URL answers

Acceptance criteria

• The previously deployed image reference is captured before the deployment mutates anything
• A failed post-deployment smoke run fails the deployment clearly and reports the new and previous references without exposing a credential
• The rollback path rests on the provider's documented current behaviour, and is either executed automatically because it has been proved to work or offered as one deterministic command
• The rollback is documented where an operator under pressure will find it

Validation

• majordomus deploy doctor
• bash test/run.sh

Evidence required

• previous_image_recorded
• rollback_path

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

An automatic rollback that has never run is a second failure mode during the first real incident. Either it is tested or it is a documented manual command.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0917.yaml. Read it back with majordomus plan show I0917.