Rollback: Safeguards and recovery

Allows rollback only to a version that already passed health gates, requires a schema-compat check, and prefers roll-forward when irreversible data migration has already landed.

Published Sep 12, 2026