What’s the rollback plan if something goes wrong?

Two safety nets, both built in:

• (1) Blue-green cutover: M1 stays warm and reachable for 72 hours after cutover. DNS / load-balancer can flip back in under 30 seconds if anything breaks. Customer-facing impact during rollback: zero, we cache-bust both ways.
• (2) 30 days post-launch coverage: anything that breaks because of the migration (data inconsistency, redirect miss, payment hiccup, missing email template) gets fixed at no extra charge for 30 days. After that, optional monthly retainer for continued cover.

We also keep the final M1 database snapshot for 90 days, if a customer reports a missing 2017 order on day 60, we can reconstruct it from the snapshot.