Changing the default boot‑failure rollback policy for NixOS generations

NixOS creates a separate GRUB entry for each system generation, allowing a manual rollback to a known‑good state after a failed upgrade. However, the project has not defined a default policy for automatically booting the previous generation when the system fails to start. The decision must balance safety against the risk of repeatedly booting a broken generation, consider limited console access on remote machines, and account for the fact that mutable directories such as /etc and /var are not versioned.

Goal: determine whether NixOS should enable an automatic boot‑into‑previous‑generation mechanism on boot failure and, if so, under what conditions it should be triggered.

Questions:

• Should the system attempt an automatic rollback after a boot failure, and what failure detection criteria should be used?
• How should the automatic rollback respect the system.maxGenerations limit?
• What safeguards are needed to prevent infinite rollback loops when the previous generation is also unbootable?