A failure on one server reverted the other one too, even when it had deployed cleanly, and a failed cache upload could undo a successful deployment. Rollback now runs per machine, the upload is best-effort, and the jobs that reach out over SSH have time limits instead of inheriting the six-hour default. Also adds read-only token permissions and makes two pipelines report failure instead of silently succeeding. 💘 Generated with Crush Assisted-by: Crush:claude-opus-5