Write rollback criteria before you cut, not after it hurts.

Cutover without abort rules is scheduled hope

The freeze window is on the calendar. Dual-run is mentioned. Someone says “we can always switch back.” At 1 a.m. a signal trips and the room invents who may abort, what counts as evidence, and which system restores first.

That improvisation is the failure mode. Rollback is not a vibe. It is a set of criteria you can read aloud under stress: what must stay green, who may call it, what evidence proves the call, and the restore path for each critical system.

This note gives you the TWIMCO Cutover Rollback Criteria Card—distinct from a full cutover one-pager (freeze, dual-run, watch, done-means) and from recovery pattern libraries used after failure. The card is the abort/revert contract you fill before freeze. Partnerships that treat verification as inspectable work—like Sutton|Place—are the operating reference: who may act and what evidence supports the act stay written down. Cutover automation around handoffs often scopes under business process automation.

A forthcoming studio tool at /tools/cutover-rollback-criteria/ is planned to turn a cutover plan into these fields interactively. Until it ships, copy the card fields below onto one page and fill them in a working session—not in a silent comment thread.

Abort is a success mode when evidence says so. Teams that treat abort as shame leave blanks on the card and then argue at the worst moment. Prefer a short, filled card over a long deck that never names the caller.

Bring the people who will be awake during the window into the fill session. A card signed by people who sleep through cutover is theater. If vendors or partners must honor abort, put their contacts and confirmations on the same page.

Four fields of the Cutover Rollback Criteria Card

Fill every field. Blank cells mean you are not ready to freeze.

1. Abort triggers (what must stay green). List the signals that, if they leave the allowed band, force abort or revert. Field shape—not invented thresholds: payment write success for a named compare window; order create vs fulfill mismatch beyond an agreed count you set from your own volume; dual-run compare job red for N consecutive runs you choose; customer-visible error queue above a staffed capacity you name. Write the signal, the source system, and the allowed band in your units. Do not paste industry benchmarks you cannot defend.

2. Named rollback caller. One primary person (and one backup) who may call rollback. Not a rotation emoji, not “the bridge.” If a second signature is required (finance for money-path revert, legal for disclosure-facing cut), write that requirement into the field before Saturday. Authority in the room matters as much as technical ability.

3. Evidence required. What must be visible when the call is made: a link or screenshot of the signal, a timestamp, the dual-run compare output, or the queue view an operator would open. “It felt wrong” is not evidence. “They said they support rollback” without a practiced path is not evidence.

4. Restore path per critical system. For each system that would be wrong if you stay on the new path—auth, payments, inventory write, notification outbox, seller tools—write the first three restore steps, the owner of those steps, and what “restored” means in the record. If two systems must restore in order, write the order.

Optional fifth: Customer/comms owner for status if the cut touches promises people can see. Pre-approved abort and thaw language belongs beside the card.

The unreproducible asset is this field set with your filled abort triggers, named caller, evidence lines, and restore steps for a real cut—not a generic prompt to “plan rollback.” Competitors can suggest “have a rollback plan”; they cannot reproduce your dated, named, evidenced card.

How the card sits beside related cutover paper

Use the rollback criteria card when the missing piece is abort authority and restore paths. Use a cutover runbook one-pager when freeze window, dual-run check, first-hour watch, and done-means are still blank. They should agree: the rollback owner on the one-pager is the named caller on this card; done-means should not contradict abort triggers.

Staff the call. If the same person holds freeze announce, compare reading, and rollback decision, write a backup or narrow scope. Concentration risk shows up as silence when the signal trips.

External writers matter. Payment processors, carriers, identity providers, and seller tools that still write during your internal freeze are not a freeze. List which external parties must honor abort and who confirms they received notice.

Access that “worked last month” fails cutovers. Confirm the rollback caller still has credentials and environment access required at cut time—before the window. Rotate and test access as part of rehearsal.

Define abort before cut: conditions under which you never leave freeze into the new path. That is different from revert after partial cut. Write both if both apply. Partial cut without a restore order is how teams create split-brain state and then invent ownership.

When dual-write or dual-run is in play, abort criteria must say what happens to the second writer. Leaving dual-write “for a few more days” without an owner is how temporary becomes permanent.

Rehearse the call, not only the script

Fill the card in a room with eng, ops, and the business owner. Read each abort trigger aloud. Anything that requires “we’ll know it when we see it” stays blank until rewritten as an observable signal.

Tabletop once: say a trigger, name the caller, walk the first restore steps for the most critical system. Time the walk. If the room cannot finish without opening three undocumented runbooks, the card is incomplete.

Practice the evidence open: the compare job URL, the queue view, the dashboard panel. If evidence takes ten minutes to find, it will not be found at 1 a.m.—fix the link on the card.

Attach the filled card to the change ticket. After cutover—whether you aborted or not—update the evidence and restore fields with what actually happened so the next cut inherits truth.

If dual-run extends, that is a new decision with an owner—not an accidental lifestyle. Extend abort criteria when the window extends. Write the extension decision with a date and a name.

Communications templates belong beside the card: abort called, revert in progress, thaw, and done-means reached. Pre-approved language prevents improvisation on a stressed bridge.

Failure modes the card catches

Rollback by committee. Everyone can suggest; no one can decide. The named caller field refuses that blank.

Green dashboard theater. Infrastructure greens while a silent order backlog grows. Abort triggers must include customer-visible or operator-visible signals, not only CPU.

Restore folklore. “Just switch DNS back” without checking what already wrote. Restore paths name compensating checks.

Authority after the fact. Finance discovers at 2 a.m. that money-path revert needed their sign-off. Second signatures belong on the card before freeze.

Shame culture around abort. Teams that punish abort leave blanks and then escalate late. Treat abort-with-evidence as a success in the postmortem language.

These patterns are delivery-shaped composites, not client telemetry. When you see them, leave Conditional blanks dated—not fake Passes. Keep this card alongside security and commercial diligence. Strong abort criteria do not waive either.

Put this into practice

1. Copy the four fields (plus optional comms owner) onto one page before the next freeze discussion.
2. Name the primary and backup rollback callers; write any second-signature rule in the same session.
3. Convert vague fears into abort triggers with source systems and allowed bands from your own inputs.
4. Walk the restore path for the most critical system once before the window; store evidence links on the card.
5. Ground the operating standard in how partnerships like Sutton|Place treat verification as inspectable work; scope handoff cutovers under business process automation.

Schedule the freeze only when the Cutover Rollback Criteria Card has no blank required cells. Abort with evidence is a success. Improvised authority at 1 a.m. is not.