History: undo one change, roll back, titled saves#1742

_{P2 Badge} Validate route order only when the selected undo affects routes

When a saved revision both reorders existing custom routes and changes an unrelated setting such as replicas, selecting that setting enters this per-change branch only after the unconditional keeps_route_order check. That check rejects the entire revision because of the route reorder, so the independent row undo returns a conflict even though no route effect was selected. Determine the selection before applying the route-order restriction, and enforce it only for whole-revision or route-affecting undos.

Useful? React with 👍 / 👎.

Fixed in 2b7432b84. Undo of one change now checks route order only when the selected changes include a route, so a reorder elsewhere in the save no longer blocks it.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Undoing a new Volume or Config can also delete a new Service that mounts it.

Effect::ServiceLifecycle(Added) currently includes the Service's mounted Volumes and Configs in Uses. If the same save adds the resource, drags links the resource creation to the Service creation. Undoing the resource then closes over and removes the Service as well.

Keep only the Service's variable lineages for an added Service. The mount effects already remove the resource's attachments. Preserve the full Uses set for Lifecycle::Removed.

By design per the build brief: undoing the referenced thing undoes its same-save referrers ("Undo N changes"), and a new service's mount is part of that save. The menu shows the count before you confirm.

@nick-potts Thanks for clarifying the design. Undoing a resource intentionally undoes its same-save referrers, including a new Service that mounts it. My suggested change would break that contract. I withdraw the finding and suggested fix.

✅ Review thread resolved.

You are interacting with an AI system.

_{P2 Badge} Link mount-path updates to their replacements

When a valid revision moves an existing Volume mount from /data to /other and then mounts another Volume at the freed /data, undoing the first row selects only its Some -> Some effect because this branch discards all mount-path updates. Reversal therefore restores the old mount at /data while leaving the replacement there, and authored-config validation rejects the duplicate volumeAttachments.mountPath, so the newly advertised per-row undo fails instead of staging. Config mount directory replacements have the same gap because this helper ignores them entirely; model both the vacated and occupied destinations when computing the closure. This conflicts with the documented shipped behavior that each History row can be undone.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Fixed in 2b7432b84. A mount path move now links to the mount that took its old path in the same save, so undo takes that back too.

_{P2 Badge} Link rename rows that exchange names

When one saved revision swaps two Service names (for example, foo -> temp, bar -> foo, then temp -> bar before saving), these ServiceField::Name effects have different IDs and drags does not link them. Undoing either displayed name row therefore restores a name still occupied by the other Service, and authored-config validation rejects the duplicate services.slug, so the documented per-row undo cannot stage. Link rename effects whose before/after names occupy each other, as is done for other replacement relationships.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Fixed in abd7018e1: rows that exchange a Service name or private DNS are linked, so undoing one side undoes both (test history_undo_of_one_side_of_a_name_swap_undoes_both).

_{P2 Badge} Link both halves of variable renames

When a saved revision renames a variable from OLD to NEW, variable_changes represents it as a removal and an addition with the same stable variable ID, but this closure does not link those effects. Undoing the displayed OLD removal therefore restores OLD while NEW remains, and authored-config validation rejects the duplicate variables.id, so that row cannot be undone as advertised. Link variable lifecycle effects that share an ID so either row reverses the rename atomically.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Fixed in abd7018e1: the removal and addition of a renamed variable share its id and are linked (test history_undo_of_one_side_of_a_variable_rename_undoes_both).

_{P2 Badge} Link nested Config-file replacements

When one valid save replaces Config file a with a/b, the removal and addition are separate rows and this dependency logic only recognizes conflicting mount paths. Undoing the removed a row restores it while a/b remains, after which authored-config validation rejects the snapshot because a file occupies another file's required directory. Link Config-file effects whose restored path is an ancestor of another effect's retained path so every advertised row undo can stage.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Fixed in abd7018e1: config-file paths nested under one another are linked, so replacing a with a/b undoes as one (test history_undo_of_a_config_file_replaced_by_one_inside_it_undoes_both).

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Preserve the sealed state when selectively undoing an old variable removal.

A revision can remove web.env.A while changing web.env.B from plain text to a secret. If A is later re-added as a secret and then deleted again, selective undo of the old A removal restores its saved plaintext record. prevent_plaintext does not inspect A because it is absent from the current environment. Whole-revision undo is rejected by the unrelated downgrade of B, but selective undo stages plaintext for A.

Make selective undo retain a key's sealed-history protection. If a removed key was sealed after the selected revision, leave it deleted instead of restoring its plaintext record. Preserve restoration for keys that were never sealed.

Deferred to the follow-up that restores sealed variables unset; tracked.

_{P2 Badge} Avoid cubic work when computing linked rows

For a saved revision with N independent rows, this invokes closure once per row; each closure scans every effect and, for each candidate, scans every row to find co-rendered effects, while units performs another nested row search. History construction is therefore Θ(N³) even when nothing is linked, so a large sync or merge containing hundreds or thousands of changes can make the History request prohibitively slow. Precompute effect-to-row ownership and dependency adjacency once per plan instead of rediscovering them for every row.

Useful? React with 👍 / 👎.

Fixed in fec9c0d98: effect-to-row ownership and link adjacency are built once per plan; History for 1000 independent rows went from 2.16s to 113ms (release).

_{P2 Badge} Link file replacements across mounted Configs

When two Configs are mounted at nested directories, this comparison keys files by Config ID and never considers their effective container paths. A valid save can remove A:x while A is mounted at /etc, then add B:y while B is mounted at /etc/x; undoing only A's removal restores /etc/x while /etc/x/y remains, so mounted_files rejects the target and the advertised row undo fails instead of staging. Compute collision slots from effective mounted paths and link the corresponding file effects across Configs.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Not changing: the outcome is a refused undo with an error, never wrong data, and it needs two Configs mounted at nested paths changed in one save.

_{P2 Badge} Link volume mounts to effective Config-file paths

When a valid save replaces a Volume mounted at /etc/a by mounting a pre-existing Config containing file a at /etc, selecting the web.mounts.data row compares /etc/a only with the Config's /etc mount slot and never with its effective /etc/a file path. Reversal therefore restores the Volume while leaving the Config mounted, after which mounted_files rejects the target because a Volume mounts where a Config file sits, so the documented per-row undo fails instead of staging. Include effective Config-file paths, along with normalized Volume paths, when computing these dependencies.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.

Fixed in f8149807b: undo-row slots now use each side's effective Config-file paths (mount_dir/file per attaching service) and normalized Volume container paths (VolumeAttachment::container_path), so a Volume mount and a Config file at the same path link.

_{P1 Badge} Link both halves of a custom-domain move

When one save moves a custom hostname from one Service to another, the removal and addition are separate route rows, but routes expose no occupancy slot here. Undoing only the removal therefore restores the hostname on the old Service while retaining it on the new Service; unlike add_domain, History validation does not enforce organization-wide hostname uniqueness, so this can stage and later save two routes claiming the same domain. Link route effects by hostname across Services before permitting per-row undo. The documented shipped behavior explicitly advertises row-level undo.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with 👍 / 👎.