Roll Out and Roll Back Deliberately

Nothing goes to everyone at once. A stage is a population and a duration: one team for two weeks, then a region, then everyone. Each stage is a chance to learn something the previous one could not tell you.

The most common mistake is stages too short to observe the thing you are watching for. If the metric you care about has a lag, and the previous guide made you state it, the stage has to outlast the lag or it proves nothing.

The rollback trigger is decided in advance

Write the rollback trigger before launch, in numbers, because the moment you need one is the moment nobody wants to make the call.

At that moment the change has a champion, some of it is working, and the people in the room have sunk cost. A trigger written by those same people a fortnight earlier, when nothing was at stake, is the only version that gets acted on.

Some changes cannot be rolled back

A change that migrates data, alters a historical series, or sends something to a customer cannot be undone by flipping a switch back. For those, the rollback trigger is replaced by something else: a pre-launch gate, a specific condition that has to be true before it goes at all, plus the stated reason it is irreversible.

That substitution is legitimate and it has to be deliberate. A change with neither a rollback trigger nor a gate has simply not been thought about.