Your release notes have a Decline button

When you roll a release across four hundred customer containers, you snapshot each one first so a bad deploy has an undo. That snapshot was insurance for you. Hand it to the customer and it becomes something else.

Each pre-release snapshot is created with alias pre-v3.2 and expiry: 1. The changelog email carries a Decline button. Tap it and your handler restores that customer's container to the alias, disk as it was at release time, one call. They're on v3.1 again, alone. It costs you nothing beyond the box the container already sits on.

The window closes by itself: after a day the snapshot expires and the button stops working. No cron, no cleanup.

Rollback was a thing you did to protect uptime. Now it's a thing they do to protect their workflow.

The undo is the same. Who holds it is the product.