A rollback promise must account for the records left behind

## Rehearse the journey through the new version

The phrase rollback can sound reassuring because it suggests returning to a known state. In a software service, restoring the earlier application does not necessarily restore that state. The newer version may already have written records that the earlier reader cannot interpret. A deployment tool can complete its reversal while the business service remains impaired. The practical question is therefore not only whether the old application can be installed again. It is whether the service can continue to use the records created during the period that the new version was active.

In our fictional 2025 review, we tested forty synthetic sequences that included those intervening writes. Twenty-nine preserved compatibility initially. The eleven other scenarios exposed a gap in the proposed recovery account. A demonstration that started with old data and simply switched application versions would not have shown the same problem. The sequence mattered because the service had changed its surroundings while it was running. A reversal needed to account for that history, not just the final version number shown by the deployment system.

This finding did not establish that actual customer records had been lost or corrupted. The scenarios were constructed before the relevant features were released. That boundary made the exercise useful: it allowed us to examine a commitment before relying on it. We should not invent a dramatic production incident to make the decision sound important. A responsible leadership account can explain why a planned recovery path was inadequate and what was changed without claiming a harm that was neither observed nor required to justify the work.

The first question I asked was which versions could read and write each relevant record form during the proposed transition. That question could be answered in a small table before it became a large engineering programme. It exposed where code reversal was supported, where sequencing was required and where another authorised recovery route would be needed. Qualified client owners also needed to understand any business effect of the transition. A technically workable sequence could still withhold a capability they expected to use, and that consequence belonged in acceptance.

## Treat deferred capability as part of the result

We funded ₹1.1 crore of phased changes and rehearsal work. The revised programme passed 38 of the forty defined scenarios. Two features remained deferred, and the programme moved four weeks later than originally planned. Those facts should stay together. Describing the release as fully reversible would erase the remaining boundary. Describing the two scenarios as passed because their features were withheld would confuse a scope decision with a technical result. We had made a more defensible commitment by reducing what would be released, not by proving that the original scope was entirely supported.

The delay was a real commercial cost. Sales colleagues had discussed the planned capability, and clients had to revise their expectations. It would be easy for an engineering leader to present the correction as an obvious technical necessity and leave that disruption out of the story. I think that weakens the account. Joseph Belzethi needed to understand both the unsupported recovery path and the consequences of changing the launch. The decision was stronger when the alternatives, affected capability and additional work were visible together rather than divided into a technical success and someone else's disappointment.

Phasing also creates continuing obligations. If a transition depends on records remaining readable by more than one application version, the team needs a clear account of when that obligation begins and ends. Removing an old format too early can recreate the problem in a later release. Keeping every format indefinitely can create a different maintenance burden. Those choices need an approved sequence and evidence appropriate to the service. The point is not that one pattern solves every change; it is that reversibility is an engineered property with a defined boundary and operating cost.

I would therefore include deferred work in the programme's completion discussion. The two features were not an embarrassing footnote to hide after presenting the 38 successful scenarios. They explained the service boundary that management was asking clients to accept. A later proposal to release them should bring its own evidence and business approval. That discipline makes it harder for an unfinished item to become silently reclassified as ordinary maintenance once the main programme has closed. The obligation remains visible even when the initial investment has produced a useful, narrower result.

## Give directors a service commitment they can examine

A board does not need to choose the record format or approve the deployment script. It does need to understand the meaning of a material recovery promise. Management should be able to explain what can be restored, what remains changed and what happens to work completed between the forward change and the reversal. The explanation should include the conditions under which the promise holds. If the account only says that an automated tool can reinstall the previous version, directors have not yet heard what that action means for the business service.

I would ask for a small number of representative sequences and the reason they were selected. A list of passed tests can look substantial while omitting the situation that makes reversal difficult. The sequence that writes a new kind of record and then asks the old reader to use it is one example of a question worth examining. Other services may have different consequential boundaries. The responsibility of leadership is to make the selection explainable and to retain the limitations, rather than turn the number of tests into a substitute for understanding what they cover.

The financial account should be equally clear. Our ₹1.1 crore programme was part of approved change arrangements, with finance retaining accounting classification. It was not customer premium, a measure of avoided loss or a promise of future revenue. The four-week delay and withheld capability were effects of the decision, while the 38 passing scenarios described a defined technical result. Keeping those categories separate lets directors compare the proposal with alternatives without borrowing scale from unrelated numbers. It also makes a later review more useful because each claim can be examined on its own terms.

The lesson I carry into a first board discussion is that reversibility should be described as a service capability, not a comforting verb. A new version can leave a history behind it, and the older version must be able to live with that history if rollback is the chosen route. Where that cannot be demonstrated, leadership needs another approved plan or a narrower release. The credible account is not the one with the most confident promise. It is the one that shows precisely what can be undone, what still needs work and who has accepted the resulting business boundary.