A launch that only the consultants can reverse is not finished. We write the cutover so your team can run it, pause it, and roll it back without us on the call.
The plan names the owner of each step, the check that must pass before the next step starts, and the exact command or console path to undo it. If a step has no rollback, it does not go in the window.
Before the window
Backups are restored once in a lower environment, not just taken. Feature flags default to off. The on-call roster and the rollback owner are the same people who rehearsed the steps.
We also freeze unrelated deploys. A cutover fails more often from a surprise change than from the change you planned.
During the window
Each step is short enough to finish or abort inside the maintenance window. We watch the same few signals: error rate, latency, and the business event that proves the new path is actually serving traffic.
If those signals drift past the limit we wrote down, we roll back. We do not debug a new design in production.
After the window
The next morning belongs to your team. The runbook, the dashboard, and the rollback notes stay in the repository. That is the handoff: a cutover they can repeat without Y-Tech in the room.