Step 01 of 06
Learn the concept
Rollback is a tempting word because it sounds like time travel. It is not. Sometimes the safest repair is rolling forward, especially after a database migration changed the ground under the old code.
The ideas this is made of
Rollback is fast only when compatibility was preserved
If version N+1 changed only application code, returning to version N may restore service quickly. If it migrated a database column or emitted new queue messages, version N may not understand the world anymore.
Expand/contract keeps both versions alive
First expand the schema so old and new code both work. Then deploy code that reads the new shape. Only after old code is gone do you contract. It feels slower and prevents louder nights.
A freeze is not panic tape
A deployment freeze stops routine releases during high-risk periods or incidents. It should name scope, approvers, expiry and the break-glass path. 'Nobody deploys until further notice' is not a policy.
Time to restore measures the whole loop
The timer starts when the service is impaired and ends when users are healthy again. It includes detection, decision, rollback or forward fix, verification and communication.
bad change: new shelf IDs
old map: points to empty shelves
forward fix: update signs and catalog
freeze: stop moves until counts matchOnce the shelves moved, yesterday's map may be dangerous. Software state has the same memory, especially databases.
Roll forward or roll back
| Condition | Roll back | Roll forward |
|---|---|---|
State unchanged | Usually best | Possible |
DB schema changed | Risky | Often best |
Bad config | Revert commit | Fix commit |
Security hotfix | Maybe unsafe | Usually forward |
What these are called on the job
Time to restore — Elapsed time from user-impacting failure to verified recovery.
Break-glass — Emergency path that bypasses normal gates with narrow scope and audit.
Freeze — Temporary restriction on routine changes during risk or incidents.
Expand/contract — Migration pattern that keeps old and new code compatible across rollout.