The rollback clause
Every promotion ships with its own undo condition.
A change graduates carrying a pre-written rollback trigger: the specific live evidence that would prove the scenario wrong, and the exact prior state to restore. Deciding the exit before the entry is the same doctrine trades follow, and it converts a failed promotion from a crisis requiring judgement under pressure into a scheduled, unemotional reversal that was agreed to while everyone was calm.
- Persistence windows span multiple weeks and months; one flattering sample promotes nothing.
- Rejected scenarios stay in the library with their verdicts, because negative knowledge is still knowledge.
- Promotion updates weights or rules explicitly, so production changes are visible diffs rather than silent drift.

