Saturday lunch. The new system cannot finish day-end, and one common payment path is dead. The cashier asks the shift lead, the lead asks the owner, the owner is hunting the vendor. Nobody has authority to stop. The old cash drawer is already in the storeroom. “If there is a problem we switch back” is useless in that moment.
Write the rollback before go-live, and rehearse it once with the people who will actually do it: when you must stop, who may decide, how long the old system stays, and in what order you cut back. Do not treat “the vendor says we can roll back” as proof that this shop already can.
Trigger: a visible signal, plus a hard decision deadline
What must pause go-live immediately must be written as something you can see, not as a feeling.
Examples: a critical day-end or payment flow cannot finish; unexplained quantity or amount gaps; a payment path this shop must have fails; the day cannot be closed. Beside each line write: what you judge by (which screen, which reconciliation, which device); and the deadline to decide (for example within two hours of opening, before the first day-end).
Scene: card fails, guests are waiting. If within ten minutes you still cannot tell whether money was taken, stop on the trigger — do not try one more ticket. With a blank deadline, the floor will keep stalling.
This is not “if it feels wrong we talk.” When the signal appears and the deadline hits, you move to the decision below.
Decision maker: one reachable role, plus a deputy
Name one shop role, and a deputy when that person is away. Also write the store contact and the vendor contact under evaluation. Who staff notify before a decision — put it where the pass can see it.
Until the new setup passes the checks you agreed in advance, keep the rollback path open. Do not tear down old machines or kill old accounts before those checks pass.
Scene: the owner is on the road, phone unanswered. If the deputy is not on paper, the shift dare neither cut back nor keep going. Lunch burns waiting for one person.
Staff do not own the call, but they must know whom to shout for. Do not leave the cashier deciding to “hold another hour.”
Recovery: is the old still there, and what happens to tickets in the window
How long old systems, credentials, configs, backups and needed devices stay, and whether they still work then — write a date before go-live, not “we’ll keep it for now.” Who tries boot, login, one kitchen ticket and one day-end before that date — write that too.
After a cutback, how tickets created in the window are kept, backfilled and reconciled. If forty tickets live only in the new system, they vanish on cutback — in the drill, walk it with the roles on shift: who exports, who handwrites, who reconciles, in what order. Name an owner for each step.
Scene: drill after close. Follow the paper: stop new, open old, put window tickets into the old system, match amounts once. Note which step stuck and for how long, and put it in the rollback note. An unrehearsed rollback is only a sentence.
Cutting back is not defeat. It means the trigger hit, someone decided, the old still boots, and window tickets still have a place. Missing any of the four, do not circle a go-live date yet.