# FieldOps Cloud Rollback Runbook

Date: 2026-06-16

## Purpose

Use this runbook when a public release causes a production-impacting defect and the safest action is to return FieldOps Cloud to the previous known-good version.

## Preconditions

- Current release version is recorded in `FIELDOPS_RELEASE_VERSION`.
- Previous release version is recorded in `FIELDOPS_PREVIOUS_RELEASE_VERSION`.
- Database backup has been verified with `FIELDOPS_BACKUP_VERIFIED_AT`.
- Restore drill has been verified with `FIELDOPS_RESTORE_DRILL_VERIFIED_AT`.
- Platform owner confirms whether schema rollback or data restore is required.

## Rollback Steps

1. Announce maintenance status through the operator support channel.
2. Disable new deploys and pause non-critical background workers.
3. Capture current application logs, error summaries, release version, and database migration state.
4. Restore the previous application artifact or Git release tagged by `FIELDOPS_PREVIOUS_RELEASE_VERSION`.
5. Restore configuration values from the previous release if they changed.
6. If schema or data corruption is suspected, restore from the latest verified backup in a staging copy first, compare tenant counts, then apply the owner-approved restore plan.
7. Run the release smoke checks:
   - `composer check`
   - `tools/browser-smoke.cjs`
   - `tools/role-walkthrough.cjs`
   - `tools/auth-production-smoke.cjs`
   - `tools/production-workflow-smoke.cjs`
8. Confirm `/platform-admin/health` shows no new deployment blockers except known live-service placeholders.
9. Re-enable workers and monitor uptime/error alerts.
10. Record the incident, rollback reason, checks run, and follow-up fix owner.

## Stop Conditions

- Do not restore production data over live tenants without owner approval.
- Do not keep the rolled-back version live if smoke checks fail.
- Do not re-enable live billing/provider workers if webhook/idempotency checks fail.