There should be an option for automatic restore of a site after an update has run. Once an update runs, there should be a short countdown while your site communicates with Central to ensure it remains up for at least five minutes (more or less). During this time, there should be an option on the site Admin to rollback if problems are seen and Admin is accessible. If the site is down or inaccessible, Central should automatically restore the backup to before update so the site is restored. The option should also be available on Central to cancel rollback if the user chooses. The option is a timed countdown so it does not trigger other errors.