A drill that induced the same failure deliberately

The April incident reproduced on purpose in May, to check whether the fix worked.

# on the standby, with traffic drained
$ docker compose exec app sh -c 'unset QUEUE_CONNECTION; 
    exec php artisan queue:work'

# and the sequence, timed:
  00:00  the worker exits
  00:05  restart 1
  ...
  00:40  start limit reached, unit failed
  00:41  absence alert fires
  01:12  the deploy health check — now covering
         workers — fails and the rollback runs
  01:48  workers healthy on the previous release

Reproducing an incident deliberately is the only way to know a fix works, and this one revealed that the extended health check takes seventy seconds to notice — which is within the rollback window and is longer than anybody had assumed. The number is now in the runbook rather than being a guess.