> For my own projects (none of them especially high traffic or commercially critical) I have undertaken to run without any rollback scripts required.

I’ve been using Phing and DbDeploy for over a year now, and my patches always stop at –//@UNDO. Although theory dictates you should be able to “go back in time”, this does create more of a hassle than it is worth. I have one giant “roll-back” strategy though: I dump the database in a backup file before executing a patch, so if it does destroy everything, I can always recover from backup. If I made an error in a patch, I create a new patch rectifying that error and deploy that. Effectively, that’s a really good roll-back strategy.