docs backend evidence cd ZD 01

ZD-01 — Deployment safety and recovery

Status: LOCAL_DONE / INTEGRATION_PENDING Validation: PASS (local source; live installation OWED)

B-BR-CD-ZD-01: Given a verified deployed release, a candidate must descend from it and remain reachable from main. Behind/diverged/unknown comparisons fail closed before cluster actions, with a refusal receipt.

B-BR-CD-ZD-02: Given a failed candidate, later runs skip that SHA until a different candidate or explicit plan --recheck <sha>. Failed rollback or landing restoration creates a durable operator hold; all commands except explicit release-hold refuse while held. Operator actions use the same lock.

BUC-CD-ZD-01: The timer verifies the signed immutable candidate, checks the deployed floor, journals mutations, migrates, rolls out, checks public reads, switches landing, checks it, then records current last. A killed run resumes the pinned candidate and the same previous landing/rollback identity before considering a later release. Busy lock defers without mutation. Recovery never rolls schema backward or manually rewrites current/receipts.

Acceptance: negative ancestry/network/malformed-state cases, rejection latch, exact recheck, failed rollback/hold/release, lock contention and killed-process recovery before rollout and before current; existing harness and static checks.

Validation on parent d9fa3db0 plus this task: RED 17 missing safety assertions; GREEN make test-deploy-agent 221 assertions, zero failures, including real SIGKILL at migration, rollout and immediately before/after current replacement. shellcheck, bash -n, release workflow guard, git diff --check passed. No dependency, secret or private connection detail added; no VPS mutation. The shared lock now deliberately defers with exit 0 instead of failure. Journal pins the immutable candidate and original rollback revision/landing; post-switch smoke occurs before current. Live safety/drill acceptance remains OWED until the new agent is installed with explicit approval.