> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/exact-release-rollback.md).

# Exact release rollback

Use this procedure when a promoted web/control-plane release fails health, browser, asset, configuration-boundary or post-promotion checks. Rollback never changes signer keys, execution-store contents or order state.

## Preconditions

The Release Owner must identify the current and candidate rollback directories as explicit seven-hex paths under `/opt/nytshift/releases`. The rollback candidate must already have its original archive, receipt, `RELEASE_COMMIT`, `RELEASE_SHA256` and accepted health/browser evidence. Never select “the previous folder” by modification time, a glob or an unresolved variable.

Keep `EXECUTION_MODE=disabled`, `ARCUS_EXECUTION_MODE=disabled`, `HYPERLIQUID_MAINNET_ENABLED=false` and `ARCUS_MAINNET_ENABLED=false` throughout rollback unless an independently authorized incident plan states a narrower already-disabled venue boundary.

## Procedure

1. Capture the exact current symlink target, service unit/environment hashes, Nginx/TLS hashes and `systemctl status nytshift.service` in the private incident record.
2. Re-run `pnpm release:public:verify` against the retained rollback archive/receipt and exact 40-character commit. Require `state: verified` and matching archive/tree digests.
3. Read the candidate directory's `RELEASE_COMMIT` and `RELEASE_SHA256`. Require exact equality with the verified receipt and archive digest. Reject a missing, writable-in-place or inconsistent directory.
4. Create a new symlink beside `current` that points to the explicit verified candidate directory. Atomically rename that symlink over `/opt/nytshift/current`; do not recursively copy or extract over either release.
5. Restart only `nytshift.service`. Require active/running state and `/api/health` reporting the rollback commit and digest pair.
6. Verify HTTPS redirect, `/`, `/terminal`, `/nightshift`, `/status`, all discovered first-party CSS/JS assets, desktop Chromium and 390/360-pixel mobile Chromium. Fail on console warning/error, page error, first-party 4xx/5xx other than the deliberate 404 fixture, serious Axe violation or horizontal overflow.
7. Re-hash service environment, Nginx and TLS configuration. Any unexpected change keeps the incident open.
8. Preserve the rejected immutable release, its archive/receipt, service journal and browser artifacts. Do not edit it to make the incident disappear.

## Roll-forward or failed rollback

If the prior release does not verify or fails its own acceptance gates, do not hop among releases. Keep the service disabled or on the last known deterministic state, leave all execution modes disabled and escalate to the Incident Commander. A new build is a new immutable release with a new receipt; it is not a modification of the failed one.

Record the from/to commits and digests, atomic switch time, service/config pre/post hashes, health result, browser gate result and Release Owner approval in the rehearsal/incident record.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/exact-release-rollback.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.