Rollout

Mechanism

Creates a durable RolloutManifest before enabling the EjectionSeat or dispatching work, then executes the approved `operation_sequence` in an ExecutionManifest as state-changing Acts inside a CircuitBreaker envelope. Before dispatching any canary or forward state-changing action, Rollout creates a `prepared` manifest entry containing a discoverable idempotent inverse for Compensate that is safe to invoke when the forward outcome is unknown. The entry becomes `armed` before the action is sent, and its `outcome: unknown` is replaced only when an outcome is observed. If no safe inverse can be prepared, Rollout refuses that action and enters the same terminal cleanup path as a breaker trip. Rollout first runs a bounded real-path Canary. `proceed` is the sole authorization for full execution or commitment of canary progress. On `caution` or `abort`, unless preempted by EjectionSeat, Rollout invokes Break, invokes Compensate for every armed canary entry whose outcome is effectful or `unknown`, records the result, permits only DESTROY or RECYCLE, freezes the manifest, and terminates this run; retry requires a new Rollout. An inverse-preparation failure or breaker trip, unless preempted by EjectionSeat, invokes Break, stops forward execution, invokes Compensate for every armed entry whose outcome is effectful or `unknown`, records every per-inverse result, freezes the manifest, and terminates this run; neither breaker recovery nor retry resumes it, and either requires a new Rollout. A received EjectionSeat signal always takes precedence over all cleanup paths: PAUSE suspends forward and compensation work and leaves the manifest open; TERMINATE stops new forward work, invokes Break, permits best-effort Compensate during graceful shutdown without allowing acknowledgement or cleanup to block termination, and then freezes the manifest; EMERGENCY halts immediately with no compensation and no final-write guarantee, so only an incomplete immutable prefix with no guaranteed final outcome entry is available. Outside EMERGENCY, Rollout freezes the manifest when the run terminates.