Module rollback 

Anti-rollback and staleness verdicts (REQ-ROLLBACK-001, DD-005).

The SUIT/Uptane discipline: the client persists, per release line, the highest release counter it has ever accepted — the high-water mark — and hard-rejects any layer below it. Counters are scoped per line, so a consumer frozen on 2026.07 keeps rollback protection inside that line without ever being pressured toward 2026.08.

Time is an input, never sampled here: staleness verdicts are pure functions of (issued-at, now, threshold), so they are testable and the trusted base stays free of clock-reading policy.

Structs

HighWaterMarks

Persisted high-water marks, one per release line, stored under the varve root (NOT inside the core — the core holds evidence, this is client state).

Enums

RollbackError

RollbackVerdict

Outcome of the anti-rollback check for one manifest.

Functions

epoch_days

Days since the civil epoch for the date part of an RFC 3339 timestamp. Day resolution is deliberate: staleness policy is measured in days, so sub-day precision would only manufacture spurious boundary cases.

staleness_warning

Staleness verdict: how old is the layer’s issued-at relative to now? Both are RFC 3339 strings; threshold_days is policy supplied by the caller. Returns Some(age_days) when the layer is older than the threshold — a warning, never a rejection: a frozen consumer’s layer aging is expected, staying silently ignorant of it is not.