Summary

• introduce immutable service_revisions snapshots and bind rollouts and deployments to an exact revision
• build agent expected state from authoritative revision specs, including deterministic container spec hashes
• add capability-gated full cutover tooling, fresh-schema constraints, and an operator maintenance runbook
• harden rollout promotion, rollback, retry cleanup, stateful placement, serverless wake-up, and legacy container recreation
• add per-action reconciliation backoff and prominent upgrade-required server health reporting

Why

Deployment behavior was derived from mutable live service rows, so editing configuration could change the desired state of already-created deployments. Immutable revisions make the deployed specification explicit and auditable, while keeping rollout and agent reconciliation tied to the same source of truth.

Impact

This is a full switch with no backwards-compatible mixed-agent mode. The release requires the documented maintenance-window cutover and upgraded agents advertising the service_revision_v1 capability. Existing containers are recreated one at a time; images are pulled before removal, but each container has an inherent stop-to-start gap because its static IP is reused.

Validation

• pnpm vitest run — 118 tests passed
• pnpm exec tsc --noEmit
• pnpm build
• go test ./...
• generated fresh-install Drizzle DDL and verified composite uniqueness precedes both revision foreign keys
• parsed both Compose YAML files
• git diff --check
• final full-diff self-review completed with no remaining actionable issues