Make the deployment logic inspectable.

State boundary

Every state item has a category used by the deployment blueprint, expected Compose evidence, a consistency-aware backup boundary, and an application-level restore proof. Display labels and planning state come from the same record.

Update gates

Every workload passes through capture, quiesce, apply, and verify. Each gate has an observable completion condition so pulling an image cannot be mistaken for a completed application update.

Recovery acceptance

Rollback always joins the prior application model with compatible state. Recovery finishes only after representative identity, read, write, state, integration, and public-entry workflows pass.

Memory floor

RAM = application + database/cache + host reserve, rounded upward to the next half gigabyte. The three inputs stay visible so a provider’s advertised RAM is not compared with an unexplained total.

Storage floor

forecast state = current state + monthly growth × horizon. The state target is divided by the remaining share after the selected operating reserve, then the separate system, image, log, and temporary allowance is added.

Transfer floor

monthly transfer = expected public egress × (1 + reserve). Private-only plans assert no public-transfer floor, but still retain outbound-dependency and private-ingress verification.

Backup trigger

State-bearing image changes, removed services, and removed or retargeted mounts require a recovery point before the proposed model is applied. Other changes retain an explicit migration confirmation.

Verification trigger

Every structural change produces a post-change verification scope from the categories and services that moved. Schema issues require a clean re-render before comparison can be treated as ready.

Rollback trigger

A changed model keeps the previous rendered configuration, prior image references, required environment sources, and compatible state recovery point together. Environment values are never emitted in the result or copied plan.