The agent deploys with one finger on the restore

The agent that deploys your app at 2 AM follows a four-call runbook. POST a snapshot with a pre-deploy alias and expiry: 30. Run the deploy script through the terminal endpoint. GET the app's health URL. Anything but 200, and it PUTs the snapshot name back: code, config, data, packages, the whole disk, restored in one call.

No migration-down scripts. No "roll back the code and hope the data matches." The rollback isn't a reverse procedure the agent has to get right under pressure; it's a return to a state that already existed.

Thirty days later the snapshot expires on its own, because a deploy that worked doesn't need its parachute forever.