Release and deployment

Release risk is dominated by batch size. Large infrequent releases are dangerous because many changes land at once and nobody can tell which one broke it — so teams release less often, which makes each release larger. The loop is the problem.

Separate deploy from release

Deploying code and exposing behavior to users are different acts, and coupling them forces every deployment to be a business decision.

Decouple with flags: deploy continuously, expose deliberately. This makes rollback a configuration change rather than a redeployment, which is the difference between seconds and minutes at the worst possible time.

Flags are inventory and rot. Give each an owner and a removal date; a codebase full of stale flags has combinatorial states nobody has tested.

The pipeline is the quality gate