Rollback

Code rollback (fast)

• Railway: railway rollback --service <svc> --environment production (redeploys the previous successful deployment), or re-run the Deploy workflow against the last green commit.
• Self-host: git checkout <last-good-sha> and docker compose -f docker-compose.prod.yml up -d --build.

Roll back backend, web, marketing as needed; the marketing site is static and low-risk.

Database rollback (careful)

• Prefer forward fixes over down-migrations. alembic downgrade -1 only if the down migration is known-safe and no new-shape data has been written that the old code can’t read.
• If a migration corrupted data: stop writes, restore from the latest good backup into a new DB, validate, then cut over (backup-restore.md). Communicate potential data-loss window.

After rollback

• Confirm GET /health, error rate normal, a real user flow works.
• File a follow-up to fix forward; do not leave prod pinned to an old commit longer than necessary.