A change you cannot undo is a change you will regret

The safe changes are the ones with a way back. A change with no way back turns a small mistake into a long outage, and it forces every decision before it to carry more weight than the change itself deserves.

Decide the way back before you start

Before a change begins, name the single step that reverses it and how long that step takes. If the answer is that there is no step, or that the step takes hours, the change is not ready to run yet, whatever the plan says.

Keep the old thing working until the new thing is proven

The moment to remove the old path is after the new one has carried real work, never before. Keeping both paths alive for a time is what makes the return a single step rather than a rebuild.

def apply(change, previous):
    if not change.checked:
        return previous, "refused"
    return change.value, previous

Prefer a small reversible step to a large correct one

Two small steps that can each be undone are safer than one large step that cannot, even when the large step is the cleaner design on paper. Reversibility is worth more than elegance when the system is live.