helm upgrade --atomic waits for all resources to reach a ready state and, if anything fails or the timeout expires, automatically runs a rollback to the previous revision. The flag turns on --wait implicitly; specifying --wait separately changes nothing.
The operational trap is that a failed atomic upgrade destroys the evidence. The pods that failed to become ready are deleted as part of the rollback, so their logs are gone and kubectl describe shows the restored old objects. Debugging a CI failure then requires rerunning without --atomic.
The default --timeout is five minutes, measured for the whole operation and not per resource, which is short for charts that pull large images. A related sharp edge: an upgrade interrupted while in progress leaves the release in a pending-upgrade state, and every later upgrade fails with another operation is in progress. Helm 3.12 and later can clear this with helm rollback to the last deployed revision; there is no lock to delete manually because the state lives in the release Secret.