Run the production checklist

We have deployed Field Notes a dozen times by now. The last step of the course is to ship it once more, properly, and leave behind enough evidence that someone else could run it. A green build is the start of that, not the end.

The checklist

Go through these on the production domain, not on a preview, and tick each one only when you have looked:

• the production domain serves the commit you expect (vercel inspect field-notes.vercel.app)
• home page, one note, a missing note, and /api/health return the right status codes
• creating a note works and the new note appears
• environment variables are scoped, and Production doesn’t share a database with Preview
• the custom domain resolves, HTTPS works, HTTP redirects
• team roles, tokens, and Deployment Protection are set the way you decided
• runtime logs show the smoke-test requests you just made
• at least one alert exists, with an owner
• usage alerts or spend controls are on
• you know the deployment id you’d roll back to, and it still works with today’s data

Ten lines. Most take under a minute each. Skipping them is how a working app becomes an incident on a Sunday.

Attach evidence to the release

Write a short release note and keep it with the project. Mine look like this:

Release 2026-09-08
Deployment: dpl_7Hk2mQ9pL4nR (commit 8c1d2e4)
Production: https://notes.flaviocopes.com returns 200, /api/health {"ok":true}
Smoke: created note "release check", opened it, deleted it
Migrations: none
Rollback target: dpl_5Fg1xR8tK2wM (commit 4f2a9c1), verified compatible
Alert owner: Flavio
External systems that make rollback unsafe: none today

That last line matters more than it looks. When a future release adds a migration, it changes from “none” to a real warning, and whoever rolls back reads it first.

Write the runbook for someone else

The test of a runbook is whether a person who didn’t build the project can follow it at 2 AM. Give exact places to look, not descriptions. “Open the Logs tab, filter by the production deployment, sort by status” beats “check the logs”. Include the decision point: which symptom means roll back now, and which means investigate first. And list the steps that bring Git, the data, and the credentials back in agreement afterwards.

Plan the ending too

If Field Notes is a course project, deleting it is part of the job. Remove the domain, revoke tokens, delete environment variables and the credentials they pointed to, disconnect integrations, and drop the external database. A forgotten project with a live token and a paid database is both a security hole and a bill.

Try this on your own project: deploy the final Field Notes release, run the full checklist, do one rollback drill, and then hand the deployment and recovery notes to another person and watch them follow the steps without asking you anything.