The whole illumos family has degrees of this; SmartOS is of course full immutable with a ro OS that can be replaced to update, but even ex. OpenIndiana applies core OS updates to a clone of the root filesystem and you can always roll back to a snapshot.