Rollout Safety

Blast radius as the organising idea: version coexistence, canary analysis against a baseline, rollback that is actually safe, and when rolling forward is the only option.

Version Coexistence: N and N+1, in Both Directions

Any deploy without downtime runs two versions of your code against one set of state — and rollback runs them in the other order, which is the direction nobody tests.

Q · For how long, and under what obligations, do two versions of my code have to work at the same time?
Canary Analysis: Compared Against What?

Deciding whether a candidate is healthy by comparing it against a concurrent baseline on errors, latency, saturation and business outcome — and never on CPU alone.

Q · The canary is running. What do I compare, what do I compare it to, and what result means "continue"?
Rollback: Only Useful If It Is Actually Safe

Going back to the previous version is the fastest way to end user impact — until the change made the previous version invalid, at which point what you are doing is not a rollback.

Q · Can I actually go back, how long does it take, and what does going back fail to undo?
Roll Forward: When Going Back Is the Harder Option

Irreversible migrations, side effects already emitted and dependencies that moved on — the situations where the fix has to go forward, and how to ship one safely under pressure.

Q · The change is bad and reverting it would be worse. How do I ship a fix under time pressure without making a second incident?
Blast Radius: If This Is Wrong, How Much Does It Affect?

The organising question of the whole domain — one test, one user, one tenant, one percent, one zone, one region, everyone — and why the honest answer is usually larger than the intended one.

Q · If this change is wrong, how much can it affect — and what, specifically, would stop it from affecting more?
Reducing Blast Radius

The techniques that move a change down the ladder — exposure control, partitioning, staging, privilege limits and reversibility — and the ones that appear to contain and do not.

Q · I know how far this change could reach. What actually makes that number smaller?
Change Size: Why Small Changes Are Safer, and When They Are Not

Small changes make cause and effect legible, review effective and rollback cheap — but diff size and blast radius are different axes, and confusing them is how one-line outages happen.

Q · Why does shipping smaller changes more often make a system safer, and what does "small" fail to guarantee?
A Successful Deploy Is Not Evidence of a Healthy System

The pipeline reports success when bytes moved and a process answered a health check — which is several layers short of the system doing what it exists to do.

Q · The deploy succeeded. What have I actually learned, and what would I need to check to know the system is healthy?