Last-good is an alias the agent moves

Your product updates each customer's site nightly: new plugin versions, regenerated pages, a reindex. Forty customer containers, one agent prompt, one rule.

Before touching anything the agent POSTs a snapshot of the container. It applies the update, then runs the checks: homepage renders, login works, search returns results. On green it moves the last-good alias to tonight's snapshot with one PUT. On red it restores the snapshot still carrying last-good from the night before, files a todo with the failing check, and moves on to the next container.

Thirty-eight customers advance. Two stay exactly where they were yesterday, and nobody notices because nothing on their site changed.

Snapshots are copy-on-write deltas, so forty nightly snapshots cost almost nothing. Rollback is not a procedure the agent follows; it is an alias the agent never moved.