Appearance
YY.M.P — Rollback plan
A rollback plan without a trigger is a document nobody knows when to open. The decision criteria below are agreed before deploy, not improvised during an incident.
Decision criteria
| Field | Value |
|---|---|
| What is watched | |
| Threshold | |
| Observation window | 24h |
| Who decides |
G5 cannot pass until the observation window has elapsed.
Per-change rollback
| CR | Reversible | How to undo | Forward fix (if irreversible) |
|---|---|---|---|
Irreversible changes
Listed separately because pretending otherwise is dangerous. These cannot be rolled back; the only path is forward.
- Data migrations — rows are changed;
git revertdoes nothing. - Store uploads — Play never reuses a
versionCode; a rollout can be halted, not un-shipped. - Sent email / third-party config — already left the building.
Surface-specific
- Backend — compensating expand-contract migration, never an in-place edit of a merged one.
- Edge Functions —
git revert+ redeploy. - Web PWA — Cloudflare Pages instant rollback.
- Stores — halt the rollout, then ship a fix as a new build. There is no "undo".