Refuse incompatible relups before OTP changes a node #11

Outcome

Fail a relup before install_release reaches its point of no return when the running application topology is incompatible with OTP release handling.

Evidence

The production upgrade from 0.2.1 to 0.2.2 on 2026-08-22 failed while OTP inspected libring. HashRing.Supervisor is a DynamicSupervisor, and release_handler raised badrecord while looking for the application top supervisor. The coordinator stopped after the first node, the node remained healthy on permanent 0.2.1, and the exact candidate reached production through the immutable rolling fallback.

Work

• Add a production-runtime compatibility preflight before install_release.
• Return a bounded, explicit error that identifies the incompatible application and supervisor.
• Do not attempt a reverse install when the current release never changed.
• Add a regression test that includes the real libring supervisor topology.
• Make the release gate either prove relup compatibility or classify the candidate for rolling replacement.
• Update the relup and production fallback runbooks with the tested behavior.

Acceptance criteria

• The relup refuses the candidate before the point of no return.
• The node remains on the previous permanent release.
• The deployment receipt records the exact failure and candidate identity.
• The same candidate remains eligible for the immutable rolling fallback.