Rehearse Your First AI Rollback Before You Open the PR

Do not merge your first AI patch yet.
Rehearse the rollback while the branch is still cheap.
If undo takes more than ten minutes, stop.

Why juniors skip undo

Your coding assistant will call the change small.
It will also call a later revert trivial.
Treat both claims as untested until you run them.

New juniors freeze after a bad merge lands.
The chat window still says the feature works.
Git will disagree when the default branch breaks.

This rollback drill belongs in hour one.
Keep it before you open the first PR.
Keep it before anyone else reviews your branch.

What you will leave behind

You will leave three artifacts on the branch.
You need a backup ref and a revert log.
You also need a one-page rollback card.

None of these artifacts require a model.
A model may review the card later.
You still type every git command yourself.

Preconditions

Confirm you have clone and branch creation rights.
Confirm you can reach the default branch.
Confirm you may push one extra backup ref.

Skip this drill without branch creation rights.
Skip it if extra refs are forbidden.
Ask a mentor before you invent new remotes.

Step 1: Freeze a commit you still trust

Open a terminal at the repository root.
Do not prompt any assistant during this step.
Record the commit you can still trust.

Proposed commands. Run them on a throwaway branch.

mkdir -p .rollback
git fetch origin
git switch -c drill/rollback-hour-one origin/main
git rev-parse HEAD > .rollback/start.sha
git merge-base HEAD origin/main > .rollback/merge-base.sha
git status --short > .rollback/status.before

You now have a frozen starting SHA.
You also have a quiet status snapshot.
Commit nothing until the backup ref exists.

Step 2: Create a backup ref you can find

Name the backup so a future you can grep it.
Do not reuse a random local stash.
Named refs survive a reboot and stashes often vanish.

stamp=$(date -u +%Y%m%dT%H%M%SZ)
git branch backup/hour-one-$stamp
git rev-parse backup/hour-one-$stamp > .rollback/backup.sha
printf '%s\n' "$stamp" > .rollback/backup.stamp
echo "backup/hour-one-$stamp" > .rollback/backup.name

Tell your mentor the backup branch name.
Do not assume they watch your local refs.
Write the name into the rollback card later.

Step 3: Plant a tiny reversible marker

You need a safe failure before the real patch.
Do not use production data for this plant.
A tiny tracked text file is enough here.

echo "hour-one-drill $(date -u +%FT%TZ)" > .rollback/marker.txt
git add .rollback/marker.txt .rollback/start.sha \
  .rollback/merge-base.sha .rollback/backup.sha \
  .rollback/backup.stamp .rollback/backup.name
git commit -m "drill: plant a reversible rollback marker"
git rev-parse HEAD > .rollback/marker.sha

This commit is supposed to be boring.
Boring commits teach revert without extra drama.
You will drop this marker before the real PR.

Step 4: Ask git for the reverse patch

Ask git for the reverse, not the model.
The model will invent a confident undo story.
Git will show the actual reverse hunks.

git diff origin/main...HEAD > .rollback/forward.diff
git diff HEAD...origin/main > .rollback/reverse.diff
git revert --no-commit --no-edit HEAD
git diff --cached > .rollback/revert-index.diff
git revert --abort

Read the reverse diff before you continue.
If the reverse diff looks empty, stop.
An empty reverse means your history is lying.

Step 5: Time a real revert on the marker

Now run the revert for real once.
Use a simple timer on your phone.
Stop if the clock passes ten minutes.

start=$(date +%s)
git revert --no-edit HEAD
git status --short > .rollback/status.after-revert
end=$(date +%s)
echo $((end - start)) > .rollback/revert.seconds

You just measured undo, not coding speed.
Write the seconds onto the rollback card.
If you needed extra flags, write those too.

Reset the drill branch after the timer stops.

# Proposed cleanup after you record the seconds
git reset --hard "$(cat .rollback/backup.sha)"

Your marker commit is gone after this reset.
That is the point of a rehearsal branch.
Keep the .rollback notes if you still need them.

Restore notes from the backup ref if needed.

git show "$(cat .rollback/backup.name)":.rollback/backup.name

If that path is missing, rewrite the notes.
Do not salvage notes from a dirty tree.
Dirty trees hide whether revert actually worked.

Step 6: Fill a one-page rollback card

Keep the card at .rollback/ROLLBACK_CARD.md.
Fill it with commands you actually ran.
Proposed template below. Replace the placeholders.

# Rollback card — hour-one drill

- Default branch: origin/main
- Drill branch: drill/rollback-hour-one
- Start SHA: (paste .rollback/start.sha)
- Backup ref: (paste .rollback/backup.name)
- Marker SHA: (paste .rollback/marker.sha)
- Revert seconds: (paste .rollback/revert.seconds)

## Undo the marker

    git switch drill/rollback-hour-one
    git revert --no-edit MARKER_SHA

## Undo a later AI patch (range)

    git revert --no-commit START_SHA..HEAD
    git commit -m "revert: hour-one AI patch"

## Hard stop

If revert exceeds 10 minutes, do not open a PR.

Copy only commands that already succeeded.
Do not paste hopeful commands from chat.
Hopeful commands fail during the incident.

Step 7: Prove the notes with a tiny check

Proposed check. Run it after the timed revert.

set -e
test -s .rollback/backup.sha
test -s .rollback/backup.name
test -s .rollback/reverse.diff
test "$(wc -c < .rollback/reverse.diff)" -gt 20
test -s .rollback/revert.seconds
seconds=$(cat .rollback/revert.seconds)
test "$seconds" -lt 600
echo "rollback rehearsal ok: ${seconds}s"

A failing check blocks the first PR.
That is stricter than a green unit suite.
Green tests do not prove you can undo.

Decision table for the first AI patch

Use this table after the assistant finishes.
Do not negotiate the rows in chat.
Chat is not an incident owner.

What you see after the patch	Revert now	Forward-fix instead
Reverse diff is empty or tiny	Stop and inspect history	No
Revert needs more than ten minutes	Yes, stay on the backup ref	No
Patch touches migrations or data files	Yes, unless a restore drill exists	Only with a restore owner
Patch publishes a package or image	Yes, if unpublishing is unclear	Only with a yank runbook
Patch is one clean commit on your branch	Yes, git revert HEAD	After revert is proven
Patch is twelve messy AI commits	Yes, revert the range	Squash first, then re-time
Only comments or tests changed	Still time the revert once	Yes, after the timer
Secrets or keys appeared in the diff	Revert and rotate out of band	Never leave them in git

Forward-fix is a privilege you earn.
You earn it by finishing a timed revert.
You do not earn it by a confident summary.

Repeat the drill on the real AI branch

Hour one used a boring marker commit.
The first PR needs the same five files.
Swap the marker SHA for your patch range.

# Proposed range log for an AI branch
git log --oneline origin/main..HEAD > .rollback/ai-commits.txt
git diff origin/main...HEAD > .rollback/forward.diff
git diff HEAD...origin/main > .rollback/reverse.diff

If the range contains merge commits, stop.
git revert on merges needs extra flags.
Ask a mentor before you add -m 1.

If the assistant squashed without asking, stop.
A hidden squash erases your undo map.
Restore the backup ref and rebuild the card.

Where a free model may help

A model can review the rollback card later.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.
MonkeyCode offers free model access and a free server option.
Paste the card and the reverse diff only.
Ask whether any reverse hunk looks irreversible.
Do not ask it to merge, push, or rewrite history.
Try the free options on a throwaway branch if you need that review.

Keep the model away from git push.
Keep it away from the default branch.
Your rollback card stays a human document.

Limitations

This drill does not restore migrated data.
It does not unpublish a package or image.
It does not rotate a leaked secret for you.

Binary files may not reverse cleanly.
Submodules need extra checkout steps.
Generated lockfiles can hide a one-way edit.

A local revert does not equal production undo.
Deploy pipelines may need a separate owner.
Feature flags may still need a manual flip.

Ten minutes is a teaching threshold.
It is not a production SLA.
Your team may demand a faster path.

Who should not use this approach

Do not use this with no branch rights.
Do not use this on a shared main checkout.
Do not use this against customer data dumps.

Skip it if a release owner already pages you.
Follow their runbook instead of this card.
This card is for your first hour only.

Skip it for irreversible schema work.
Write a restore drill with your DBA first.
Git revert will not rebuild dropped rows.

Close the first hour

You now have a backup ref you can name.
You now have a timed revert you can repeat.
You now have a card a reviewer can read.

Open the first PR only after those three exist.
If any piece is missing, keep the branch local.
Undo is the skill. Merge can wait.