# Updates & rollback

Updates must never become a production outage.

### Baseline requirements

* Update artifacts are immutable.
* Images and manifests are signed.
* Updates are staged (ringed rollout).
* Rollback is one action.

### Recommended rollout pattern

1. **Canary station:** one line, one shift.
2. **Soak:** 24-hour run with normal constraint events.
3. **Expand:** per-line rollout.
4. **Site-wide:** after acceptance gates pass.

### Rollback triggers

Rollback is required if any of these happen:

* sustained frame drops.
* evidence gaps.
* repeated service restarts.
* new defect rate drift without process explanation.

{% hint style="info" %}
We document behavior and gates here. Environment-specific OTA wiring is handled per site.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://intelfactor.gitbook.io/doc/home/reliability-and-operations/updates-and-rollback.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.