Deploy Watch

What it protects

Deploy Watch is an optional recovery window after a code deployment. It is disabled by default. It can recover a previous healthy version of an eligible stateless HTTP service when the new deployment repeatedly fails its configured health endpoint shortly after publication.

It is a cold recovery with possible downtime. It does not undo database writes, roll back an entire project, provide high availability, or continuously monitor public DNS and TLS.

Enable it

1. Open the service's Settings and configure a meaningful HTTP health check.
2. Open Deploy Watch and review the eligibility requirements.
3. Confirm that startup performs no migrations or background side effects, concurrent startup is safe, and the previous code remains compatible with current data and peer services.
4. Enable the setting and make the next eligible deployment. Enabling it does not protect an already running deployment retroactively.

The first release supports a single stateless HTTP instance without volumes, cron, or pre-deploy commands. A previous healthy deployment is required. Build instructions may change, but startup, probes, restart policy, resources, port, resolved variables, and network policy must keep the same effective runtime contract. Configuration changes can prevent the watch from arming; read the reason in the panel.

During the window

Upferry probes approximately every 15 seconds for 10 minutes. Three consecutive failures trigger one recovery attempt. A healthy 2xx response resets the failure counter. The previous image is kept locally and is checked before traffic is handed over. Missing images, insufficient capacity, or an unhealthy previous version can prevent recovery.

The service's Deploy Watch panel shows whether the watch is armed, completed, cancelled, or unable to recover, with its reason and history. New deployments and relevant manual or configuration changes cancel an older watch.

Turn it off

Disable Deploy Watch in the service Settings. This stops new watches and cancels active ones. The setting covers the service's environments; each individual watch belongs to one deployment in one environment.