Safety

fpm-tune writes production configuration and reloads a live master, so this section is about what it does when a step fails and what it refuses to do at all. Read it before switching a host to apply mode.

• How it fails safe: the chain from plan to reload, the rollback, the transaction record, and the two files it writes.
• The trust boundary: what it trusts, what one tenant can do to another, and what only root can reach.