I guess my point was lost. I avoid the problem of trying a rollback from a weird state largely by doing the rollback at startup rather than shutdown.
[I guess I don't understand your point, then. If you roll back at startup, then your service is unavailable for the entire lifetime of the process! -Raymond]