#221: offline update path incl. migrations, rehearsed with rollback #291

fable-5 · 2026-07-31T17:27:05+02:00

fable-5 commented

2026-07-31 17:27:05 +02:00

Closes the work for #221 (docs-only; the rehearsal itself ran in the isolated environment of #220).

docs/operations/update-runbook.md — the documented procedure: obtain (airgap: mirror per deploy/stages.md §5b), verify by digest, back up first, apply (TAG + up -d, migrate-on-start), verify health, roll back. Migration behaviour is explicit: failed migrations roll back their own transaction but block every further migrate deploy (P3009) — including a re-deployed old image — until migrate resolve --rolled-back; irreversible-but-successful migrations mean restoring the pre-update set. Version skew: no rolling updates on a compose stage, short maintenance window.
docs/vs-nfd/98-update-rollback-protokoll.md — evidence of the rehearsal: regular update v1→v2 (pre-update backup set 20260731-150833, readyz green, content intact) and one deliberate failed update (P3018 division by zero; schema change proven rolled back by the per-migration transaction; image rollback alone shown insufficient; documented recovery executed, instance fully green afterwards).
ADR 0024: decisions 5 and 6 recorded as executed (#220/#221); operations handbook §1/§2 and restore runbook cross-referenced; plan checkbox P1-3 ticked.

Issue #221 will be closed manually after green CI + merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

Closes the work for #221 (docs-only; the rehearsal itself ran in the isolated environment of #220). - **`docs/operations/update-runbook.md`** — the documented procedure: obtain (airgap: mirror per `deploy/stages.md` §5b), verify by digest, back up first, apply (`TAG` + `up -d`, migrate-on-start), verify health, roll back. Migration behaviour is explicit: failed migrations roll back their own transaction but block every further `migrate deploy` (P3009) — including a re-deployed old image — until `migrate resolve --rolled-back`; irreversible-but-successful migrations mean restoring the pre-update set. Version skew: no rolling updates on a compose stage, short maintenance window. - **`docs/vs-nfd/98-update-rollback-protokoll.md`** — evidence of the rehearsal: regular update v1→v2 (pre-update backup set `20260731-150833`, readyz green, content intact) and one deliberate failed update (P3018 `division by zero`; schema change proven rolled back by the per-migration transaction; image rollback alone shown insufficient; documented recovery executed, instance fully green afterwards). - ADR 0024: decisions 5 and 6 recorded as executed (#220/#221); operations handbook §1/§2 and restore runbook cross-referenced; plan checkbox P1-3 ticked. Issue #221 will be closed manually after green CI + merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 added 1 commit 2026-07-31 17:27:05 +02:00

#221 : offline update path incl. migrations, rehearsed with rollback

CD / Deploy to Test (push) Successful in 12s

Details

CD / Smoke tests against Test (push) Successful in 1m15s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 6m19s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 8m13s

Details

CI / Import/export fidelity gate (push) Successful in 54s

Details

CI / Lint, typecheck, test (pull_request) Successful in 6m20s

Details

CI / Build container images (pull_request) Successful in 1m12s

Details

CI / Auth e2e pack (pull_request) Successful in 8m24s

Details

CI / Import/export fidelity gate (pull_request) Successful in 58s

Details

CD / Build and push images (push) Successful in 22s

Details

18239e2fa9

Adds docs/operations/update-runbook.md (obtain, verify by digest, back
up, apply, verify, roll back) with the migration behaviour stated
explicitly: a failed migration rolls back its own transaction but is
recorded in _prisma_migrations and blocks every further migrate deploy
(P3009) — including a re-deployed old image — until migrate resolve
--rolled-back; semantically irreversible migrations have exactly one way
back, the pre-update backup set. No rolling updates on a compose stage.
Rehearsed in the isolated environment of #220: regular update to a v2
image set, then a deliberate failed-update (P3018 division by zero,
schema change proven rolled back) with image-rollback-alone shown
insufficient and the documented recovery executed. Protocol:
docs/vs-nfd/98-update-rollback-protokoll.md. ADR 0024 decisions 5+6
recorded as executed; operations handbook and restore runbook updated;
plan checkbox P1-3 ticked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit 18239e2fa9 into main

2026-07-31 17:43:25 +02:00

fable-5 referenced this pull request

2026-07-31 17:46:31 +02:00

[VS-NfD] Define the offline update path including migrations #221

Sign in to join this conversation.

No reviewers