Rollback: Safeguards and recovery
Allows rollback only to a version that already passed health gates, requires a schema-compat check, and prefers roll-forward when irreversible data migration has already landed.
Treats liveness as process-deadlock detection only, includes critical dependencies in readiness, and forbids recycling healthy processes because a downstream dependency is unavailable.