feat: enforce coherent release and rollback contract

docs/operations/release-cache-rollback.md

@@ -0,0 +1,25 @@
+# Release, cache, and rollback contract
+
+Each deployment is an immutable `releases/<releaseId>/` artifact set. The
+provider adapter must upload assets, release manifest, runtime config, and
+verify asset reachability before atomically switching the active HTML pointer.
+The post-switch boot, route, API, telemetry, and reload-loop smoke checks close
+the deployment.
+
+Rollback selects a prior release tuple, confirms its assets and runtime/API
+compatibility, atomically switches the complete set, performs the provider
+cache action, and repeats the smoke checks. Rebuilding an old commit, replacing
+HTML alone, or declaring recovery from cache-purge completion is prohibited.
+Recovery is established by old/new reachability probes.
+
+The provider-independent cache defaults are:
+
+- hashed assets: `public, max-age=31536000, immutable`
+- HTML: `no-cache`
+- runtime config and release manifest: `no-store`
+- public source maps: disabled
+- service worker/offline cache: disabled
+
+`corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
+Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
+requires the artifact to report `mode: "live"`.