Interactive graph
Rollback Principle
Table of Contents
Restore the last good state before you push - when the new state breaks, revert first, debug second.
Key Concept
- If I cannot explain the path back in one sentence, I am not ready to ship.
- Level 1: If you cannot say in one sentence how to undo a change, you are not ready to release it yet.
- Level 2: If you cannot say in one sentence how you would undo a change, you are not ready to release it yet.
- Level 3: One-sentence path back - gate before ship, not postmortem invention.
- Level 4: Because production surprises are guaranteed, rollback clarity is readiness, not pessimism.
- Level 5: If I cannot explain the path back in one sentence, I am not ready to ship - pairs with Reversibility and Safety by Design.
- Reversibility is the decision frame; rollback is the rehearsed move.
- Last quarter I kept a bad Friday deploy live because I wanted the milestone more than the rollback conversation.
- The team needed “my call, here's the fix,” not a speech.
Examples
- Bad Friday deploy - I reverted in standup, said my call, fixed Monday.
- The point guard ran Tuesday's inbound at halftime when the new play bled points - rollback was the drill they would already walked, not a whiteboard invention.
Note Relationships
| Relationship | Wikilink | Reason |
|---|---|---|
| alternative | Blameless After-Action Review | Rollback first; after-action review after calm - not root-cause while users are down |
| alternative | Failure as Feedback | Rollback is move first; root-cause learning comes after the site is calm |
| contradicts | Ship It | when milestone pride blocks calling rollback Friday night |
| contradicts | Sunk Cost Fallacy | when “we already deployed” blocks undoing a bad release |
| extends | Build a Reliable Default | Rehearsed rollback is the default when deploys go loud |
| extends | Change Window | Risky push only when revert crew is reachable |
| extends | Own the Error | Revert fast, name it in the standup, fix after calm returns |
| extends | Preparedness | Practice the undo path before the alarm owns the clock |
| extends | Reversibility | Concrete undo path - not only “prefer reversible choices” |
| extends | Risk Management | Named rollback is a control layer before irreversible harm |
| extends | Staged Rollout | Small slice first keeps rollback cheap before everyone's affected |
| extends | Standard Operating Procedures | Rollback steps belong in the runbook, not in someone's head |
| implements | Free Tier Hosting Stack | Git revert and previous Cloudflare deploy are the rollback lane |
