[makecheck]

I think it is OK to add tools to the process as long as the most critical parts are the least mysterious.

For instance, in a networked file system, the on/off switch for “move from version A to version B” ought to be about as simple as swapping a directory symbolic link. That way, everyone can see exactly what it is pointing to now, what it used to point to (as old version targets are probably in the same parent directory), and anyone can figure out how to roll it back instantly.

Given trivial on/off switches, the details of the rest of the system can start to gain complexity.

Also, it helps a lot to have something like a “beta flow” that is essentially a parallel replica of your production environment.