Traefik Mesh: Rollback safety after schema changes

Traefik Mesh currently applies configuration changes directly to Kubernetes CRDs, propagating them to Envoy sidecars without a transactional system. This means that a schema update that is syntactically correct but semantically invalid can immediately destabilize services, and the prior configuration state is not preserved inside Traefik Mesh.

Because the mesh does not retain a history of applied CRDs, a user who relies on GitOps tools must manually revert to a previous commit to recover. However, the mesh itself offers no mechanism to verify that a rollback will re‑establish a fully operational state or to detect partial failures during the transition.

Given this lack of built‑in rollback support, what strategies can be employed to make the configuration update process atomic, and how can Traefik Mesh expose a versioned history or checkpointing feature to enable safe rollbacks without external tooling?

Specifically:

• Can Traefik Mesh be extended to maintain a lightweight revision store for its CRDs?
• What API or webhook hooks could be introduced to validate a rollback candidate before it is applied?