Design the rollout so rollback takes minutes, not hours. The real cost driver was reprocessing, not inference. We learned this the hard way during a vendor swap.