> We’ve discussed doing brownouts where we fail everything for an hour with clear error messages as to what is happening.

That sounds like the best option. People are used to the idea that a service might be down, so if that happens, they’ll look at what the error is.