Upgrade safely

nautilo upgrade is the day-two replacement path for Compose profiles. nautilo deploy is not: deploy has no automatic backup and no rollback.

Plan without mutation

nautilo profile current
nautilo status
nautilo release plan

release plan previews the default server-only artifact and compatibility preflight. It is read-only. There is no release apply; upgrade owns the mutation.

Select the exact artifact

Transactional safety does not prove freshness. A mutable tag can point to an older successful build. Require a reviewed build, successful publication, and an immutable image reference whose identity you can verify.

nautilo upgrade \
  --image registry.example.org/agentsea/nautilo-server@sha256:<digest> \
  --backup-dir /path/to/operator-controlled-backups

The default replaces only nautilo-server. Use --full only when the release explicitly requires a full-stack replacement. --from-sources and --image are mutually exclusive.

Transaction boundary

The guarded path drains work, stops the Server, creates and verifies a full recovery bundle, applies the selected artifact, runs runtime acceptance, and then completes maintenance. On apply or acceptance failure it restores the bundle and prior image and proves health before clearing maintenance.

Verify and recover

After success, compare deployment identity with the immutable artifact and prove owner sign-in plus the application contract you upgraded for. If automatic rollback fails or rollback health fails, treat the target as critical: preserve the bundle, prior-image identity, logs, and maintenance state, then use backup and restore.

Application rollback does not mean an arbitrary database schema reversal. The verified full bundle is the recovery authority for data state.