1.7 KiB
Phase 2B-only rollback
Do not remove Phase 1 identity/workspace, Phase 2A packages, kernels, snapshots, production resources, or unrelated nftables objects.
For Stage 1 rollback, run only tests/31-rollback-stage1.sh from a clean artifact worktree whose MANIFEST.sha256 digest matches the authoritative state generation. The current branch may have later unrelated commits. Rollback accepts verified IN_PROGRESS or COMPLETE, uses the allowlist parser shared through tests/stage1-state-lib.sh, and refuses operation unless the approval marker, user manager, UID-1200 processes, socket, namespace, and project nftables tables are absent. Before removal it atomically renames the whole Stage 1 transaction subtree to a retryable cleanup tombstone. A retry accepts already-removed entries and re-verifies and removes any matching entries that remain. It removes only recorded matching payload/temporary files and created or pending directories; a COMPLETE record requires all 16 files. Shared parents recorded as pre-existing are never removed or altered. Immutable authoritative state remains intact through all payload and directory removals and while unreferenced state is cleaned; its manifest and checksum are removed only in the final cleanup phase.
Later-stage rollback, after explicit runtime activation, is separate: stop the user manager and namespace first, then verify the runtime is inert before using a stage-appropriate reviewed rollback. Stage 1 rollback must never be used after the approval marker is created or any namespace/firewall/runtime component has been activated.
If a destination file existed before Phase 2B, stop: Stage 1 has no overwrite/restore path and fails closed on pre-existence.