#!/bin/sh
set -eu
cat >&2 <<'EOF'
Rollback is a documented, non-destructive procedure. No rollback command is executed.

1. Identify the last known-good immutable image digest/tag and configuration revision.
2. Confirm the database backup is recent and run scripts/healthcheck.sh against the candidate.
3. Review the exact rendered config: docker compose config.
4. Change the deployment's image tag/digest in the deployment system (or pin IMAGE_TAG), then restart the service through the approved change process.
5. Verify /api/v1/health/ready, representative authenticated reads, logs, and outreach_enabled=false.
6. Record the rollback reason, old/new image digests, config revision, backup/checksum, and operator.

This helper intentionally does not stop containers, delete images, restore databases, or alter production state.
EOF