Recovery changes the design
A rollback plan written after implementation usually discovers that data has changed shape, old and new versions cannot coexist, or the original path is no longer available. Designing recovery first exposes those constraints while choices are still reversible.
Define the failure envelope
Document what can fail, how it will be detected, and the latest safe decision point. A rollback is not one command; it is a coordinated procedure across application state, data, infrastructure, integrations, and communication.
- Set measurable go and no-go conditions.
- Choose forward-fix versus rollback for each failure class.
- Verify data compatibility in both directions.
- Assign the decision maker and the operators.
- Rehearse with production-like data and timings.
Prefer reversible increments
Feature flags, additive schemas, parallel reads, staged traffic, and bounded releases reduce the size of each recovery decision. The exact technique matters less than preserving a known safe state.