Rollback Plan Pilot Prerequisite — Claude Code Guide

Rollback is a prerequisite, not a final item

A rollback plan must exist before the pilot, because after a change it may be too late to determine how to return code, configuration, data, and traffic. For every surface, specify a checkpoint, trigger, owner, command or procedure, and a way to verify recovery.

Code rollback and state rollback are different things. Returning to a branch or artifact does not undo an executed backfill, changed schema state, external side effect, or incompatible configuration. If state recovery is not proven, the decision must be HOLD.

Rollback matrix

Fields without which rollback is not a plan

• the point from which source state can be restored;
• a concrete observable trigger and decision threshold;
• a responsible owner and escalation channel;
• the order of code/config/data/routing actions;
• post-rollback verification and the condition requiring a forward-fix;
• an explicit marker for irreversible or unverified operations.

Stop condition for the pilot

## Rollback gate
- Trigger: behavior discrepancy, integrity failure, or unavailable recovery evidence
- Owner: migration decision owner
- Code action: return to source checkpoint
- Config/data action: <approved procedure — Unknown until verified>
- Verification: compare representative flow and invariants
- Decision: HOLD until all recovery steps are verified