A production update should not begin by copying new files over a running system. Before a change, the current version, dependencies, data state and acceptance criteria for the new release need to be known.
A reliable process checks preconditions and creates a return point first, publishes the new version in a controlled way, and only then runs acceptance. If validation fails, the system should return to the previous state without manual reconstruction.
Rollback is therefore designed together with the update. This turns a production change from a sequence of commands into a controlled transaction with a known starting point, a verifiable outcome and a safe failure path.