# ZD-01 — Deployment safety and recovery

Status: LOCAL_DONE / INTEGRATION_PENDING
Validation: PASS (local source; live installation OWED)

B-BR-CD-ZD-01: Given a verified deployed release, a candidate must descend
from it and remain reachable from main. Behind/diverged/unknown comparisons
fail closed before cluster actions, with a refusal receipt.

B-BR-CD-ZD-02: Given a failed candidate, later runs skip that SHA until a
different candidate or explicit `plan --recheck <sha>`. Failed rollback or
landing restoration creates a durable operator hold; all commands except
explicit `release-hold` refuse while held. Operator actions use the same lock.

BUC-CD-ZD-01: The timer verifies the signed immutable candidate, checks the
deployed floor, journals mutations, migrates, rolls out, checks public reads,
switches landing, checks it, then records current last. A killed run resumes
the pinned candidate and the same previous landing/rollback identity before
considering a later release. Busy lock defers without mutation. Recovery
never rolls schema backward or manually rewrites current/receipts.

Acceptance: negative ancestry/network/malformed-state cases, rejection latch,
exact recheck, failed rollback/hold/release, lock contention and killed-process
recovery before rollout and before current; existing harness and static checks.

Validation on parent d9fa3db0 plus this task: RED 17 missing safety assertions;
GREEN `make test-deploy-agent` 221 assertions, zero failures, including real
SIGKILL at migration, rollout and immediately before/after current replacement.
`shellcheck`, `bash -n`, release workflow guard, `git diff --check` passed.
No dependency, secret or private connection detail added; no VPS mutation.
The shared lock now deliberately defers with exit 0 instead of failure.
Journal pins the immutable candidate and original rollback revision/landing;
post-switch smoke occurs before current. Live safety/drill acceptance remains
OWED until the new agent is installed with explicit approval.