The 30-second rollback rule

If you can't undo it that fast, don't ship it. Make 'undo' a deploy gate, not a guideline.