[acamarata]

Rollback now resolves inventory credentials and server names within its target environment. Removal flag help now explains the v1.5 data-preservation default and confirmation requirement alongside v1.4 behavior.

• D-0540 — fixed: use inv.Environments[target].Servers; preserve the recorded tar's remote path and fallback credentials. Regression covers two environments sharing a host with different SSH keys/server names, plus a missing target. The naming prerequisite was already settled in feat(deploy): v1.5 remote apply ships the artifact set, previews recreates, backs up first (P7-DEPL-24) #629.
• D-0857 — blocked: probe policy is explicitly deferred to P7-SHIP; changing compatibility policy or accepting new E487 failures belongs to that work.
• D-0765 — already fixed: d3444e27 (test: macOS/Linux conformance (P7-HYG-49) #765) changed TestE487HintEnrollThenDeploy to pintest.Home(t), which handles unsafe temp ancestors.
• D-0434 — blocked: planning assigns this behavior to the next P7-CANON/P7-LIVE add/remove ticket.
• D-0745 — fixed: share corrected flag help across remove and bundle remove; add a help regression and refresh registry, OpenAPI, facts hashes, wiki, MCP golden, and SDK JSDoc.
• D-0981 — blocked: the debt row explicitly relates this work to P7-SURF-16, with completion before P7-SHIP.

Validation:

• D-0540 regression failed before the code change and passed afterward with go test -mod=vendor ./cmd/commands -run '^TestRollbackInventoryUsesOnlyTargetEnvironment$' -count=20.
• D-0745 help regression failed before correction; go test -mod=vendor ./cmd/commands -run '^(TestInstallFlagParity|TestRemoveDeleteDataHelp|TestPluginRemoveDataPolicyCmd)$' -count=1 passed afterward.
• Passed make cmd-inventory, MCP TestToolListGolden -update, make wiki-commands, and go run -mod=vendor ./tools/sdkgen -lang ts.
• Passed build, vet, and lint using repository-pinned Go 1.26.10: make build BINARY="$TMPDIR/nself", go vet -mod=vendor ./cmd/commands, golangci-lint run ./cmd/commands/... (zero issues).
• Passed whole-package tests: go test -mod=vendor -timeout 10m ./internal/mcpgen ./internal/repoqa.
• Passed make fmt-check, bin/wikigen -check, and git diff --check.
• Passed go test -mod=vendor -timeout 10m ./cmd/commands in 398.960 seconds, with no tests skipped.

An initial full command-package run with the system Go 1.27.2 timed out at the ten-minute limit while TestSurfaceIdentity was active. Its isolated clean-origin/main comparison at 68dc16a0 passed in 26 seconds, so that timeout is not claimed as a reproduced baseline failure. Final checks use Go 1.26.10 and task-local caches; this also avoids missing shared-cache files and the installed linter's inability to read Go 1.27.2 export data.

No HQ files, production systems, versions, or releases were changed. No hooks were excluded.

[acamarata]

Rebased onto origin/main and resolved the .github/facts.json conflict by keeping the incoming (PR) generated hashes, since this branch updates docs/commands that change those artifacts. Build verified clean after rebase; force-pushed to dw9-cli-4.

[acamarata]

Fixed stale facts.json hashes: ran make cmd-inventory to regenerate openapi_sha256 (01ea16e2…) and registry_sha256 (37fe98fe…). TestFactsCurrent and TestReadmeFactsCurrent now pass. Commit a02916e.

[acamarata]

Rebased onto origin/main; whole-module tests pass locally. The ratchet failures cited in the stale CI output (package-size for internal/database, godotenv-reads, docker funnel, panic baseline) do not relate to this PR's changes (docs/generated JSON/small cmd/commands fixes). No code fix was required — only the rebase.