feat(operator): gate template rollouts on restored-world canaries and successful joins #881

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

Automatic adoption is the default. The lifecycle fence can clear after a replacement pod appears. Its PVC may be retained even when the new game version changes save format or prevents a successful join.

Work

Use explicit OnRequest adoption for the production rollout path, independently pin and verify the signed module bundle and game image, and stage changes using canaries restored from real backups. Gate batches on join/save and compatible rollback evidence. Persist fleet progress separately from the per-server lifecycle owner so that a failed canary cannot deadlock restore.

Acceptance criteria

Run a bad image and a format-changing update on a clone, record pre/post PVC UIDs and data, and show the batch halts on failed joins. Exercise a compatible rollback and a restore-required rollback, including extra claims and excluded mod content.

PR ownership and prior work

Own rollout gating and rollback decisions. Reuse H03’s qualified restore fixture and M01’s join assertion. Keep CR/PVC retention behavior intact. Build on #731, #835 and TestGameServer_TemplateOnRequestRetainsData. Per-server pinning and retention already exist.

Rollout and PVC contract · Default OCI verification setting

Restored rollout qualification on ae14d5ab74b4b386688914f267d46bd1571db534

The Kind rehearsal passed all four cases on ARM64 (543.65s) and AMD64 (479.37s). Independent AMD64 rehearsal The compatible rollback kept the save readable directly. The format-changing rollback used Restic snapshot b63139d0bcf881bf22167bab7d98d562ef8bdb7b0931cfc3fe933c3350a4d282 in Restore 6acaa54e-c9f2-4333-b8ca-43b505e7b5f6, removed the candidate-only format marker, and returned the primary and extra world values. The excluded mod file retained the clone's own clone-package value.

A running HTTP-only candidate served the world marker but failed the real Minecraft handshake. The journal kept only its baseline receipt and blocked promotion. An unpullable candidate also halted the rollout. The untouched fleet member retained its original pod UID throughout. Kind rehearsal and raw receipts · Fleet admission decision tests · Successful real Minecraft join and save on a restored world in the backup parent