> For the complete documentation index, see [llms.txt](https://intelfactor.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intelfactor.gitbook.io/docs/home/reliability-and-operations/updates-and-rollback.md).

# Updates & rollback

How to update safely without risking production continuity.

Updates must never become a production outage.

### Baseline requirements

* Update artifacts are immutable.
* Images and manifests are signed.
* Updates are staged (ringed rollout).
* Rollback is one action.

### Recommended rollout pattern

1. **Canary station:** one line, one shift.
2. **Soak:** 24-hour run with normal constraint events.
3. **Expand:** per-line rollout.
4. **Site-wide:** after acceptance gates pass.

### Rollback triggers

Rollback is required if any of these happen:

* sustained frame drops.
* evidence gaps.
* repeated service restarts.
* new defect rate drift without process explanation.

{% hint style="info" %}
We document behavior and gates here. Environment-specific OTA wiring is handled per site.
{% endhint %}