feat(core): add No Silent Apply and ledger rollback

[oratis]

Summary

PR 4 of docs/FLOATBOAT_ADOPTION_PLAN.md §2.F + §2.B. Makes the ledger from #240 actionable, and gives every future high-impact application one shared ceremony instead of four hand-rolled prompts that drift.

deepcode ledger rollback chg-lz4k2p-01

confirm is required — that's the whole design

Selfware §6.3 is a four-step ritual: explain the update logic, show a summary, ask accept/reject/defer, apply only on accept — with a rollback point taken first (§7).

The load-bearing choice here is in the type signature: applyWithCeremony(plan, confirm) takes confirm as a required argument. There is no assume-yes path and no default. A caller that cannot ask a human cannot apply. That makes "no silent apply" a property the compiler enforces rather than a convention reviewers have to remember.

If the rollback point can't be created, nothing is applied. The user accepted an operation described as reversible; performing it irreversibly is a different operation than the one they agreed to.

reject and defer are ordinary outcomes, not errors — §6.3 requires the current version keep working after a reject.

Conflicts are surfaced, not silently resolved

Undoing an old change is not the same operation as undoing the last one. The plan carries the cost before the user decides:

Condition	Warning
Later edits to the same file in that session	"N later change(s) … will be discarded too"
File modified outside DeepCode since the last snapshot	"those edits will be lost"
A Bash git checkpoint	"restores every tracked file the command touched"

A post- capture of the same call is explicitly not counted as a later edit — otherwise every single-edit rollback would warn about itself and the warning would stop meaning anything. There's a test pinning that.

The rollback is itself recorded

On the governance timeline. An audit trail with an unlogged undo is not an audit trail.

Failure states return reasons, not stack traces

Snapshots and ledger records age out on different schedules, so a record can outlive the checkpoint it points at. Missing hint, missing session, and pruned snapshot each return { status: 'unavailable', reason } — these are expected states of an audit log.

In the CLI prompt, anything other than an explicit yes is a no. A mistyped answer must not overwrite files.

Test plan

• pnpm test — 1337 passed, 16 skipped (+20: 903 core, 232 cli)
• pnpm typecheck · pnpm lint · pnpm format:check · pnpm build · node scripts/check-docs.mjs

Area	Cases
Ceremony	Applies only on accept; reject/defer apply nothing and aren't failures; checkpoint strictly before apply; checkpoint failure ⇒ nothing applied; failing apply reported not thrown; asks exactly once
Rollback (real snapshots + real files)	Restores prior contents; reject leaves the file alone; deletes a file that didn't exist before; all four explanation fields populated
Unavailable	No hint / no session / aged-out snapshot each give a reason
Conflicts	Later edits warn; post- capture of the same call does not; outside-DeepCode modification warns
CLI	Restores and logs to governance; decline changes nothing; presentation reaches the prompt; unrollbackable record explains itself

Documentation

• docs/change-ledger.md — new Rolling back section: the four steps, the conflict list with the post- exclusion, and what happens when rollback isn't possible

Release notes label

• release-notes:feature

Related

Plan §2.F / §2.B (PR 4). Builds on #240. Research: docs/research/floatboat.md §4.4(4).

🤖 Generated with Claude Code