Rollback that someone will actually call
Rollback designs fail in two common ways. First, the criteria are vague — “if things look bad” — so nobody feels authorised to abort. Second, the person who can call abort is not on the bridge, or is asleep without a deputy. Either way, the team keeps pushing forward because stopping feels riskier than continuing.
Callable rollback means measurable thresholds (error rate, reconciliation mismatch, latency) and a named role with a deputy. It also means rehearsing the abort once, even if the rehearsal is awkward. People need to hear the words spoken aloud.
We write abort criteria into the runbook beside the go checks. If your culture punishes the person who calls abort, fix that culture before the night — otherwise the criteria are theatre.