Recovery and rollback

Interrupted running jobs become failed rather than silently duplicated. Rollback restores the prior release pointer and data/environment snapshot when a schema-changing release fails.