回滚：保障措施与恢复
仅允许回滚到已通过健康门的版本，要求进行 schema-compat 检查，并且在不可逆数据迁移已生效时优先选择向前滚动。
Treats liveness as process-deadlock detection only, includes critical dependencies in readiness, and forbids recycling healthy processes because a downstream dependency is unavailable.