Collection
Change live systems without turning one mistake into a large one
Make software, configuration and bulk-data changes easier to test, observe, retry, stop and recover before their blast radius becomes the main problem.
15 elements · Explore in any order.
3 checklists · 1 heuristic · 1 pattern · 2 principles · 8 protocols
15 elements
Stage the mutation before committing it
The safest write is often the one you can inspect before it becomes a write.
Read the idea ProtocolCanary the batch before scaling it
Do not make the millionth write your first realistic test.
Read the idea ChecklistWrite the rollback trigger before deployment
'We will know when to roll back' is not a rollback condition.
Read the idea ProtocolTest the rollback before you need it
A rollback plan that exists only on paper is a hypothesis.
Read the idea PatternGive a retryable mutation one stable operation ID
A retry should mean 'finish this operation,' not 'please create another one.'
Read the idea ProtocolRetry slower, with randomness, and stop
A retry storm is an outage trying to help.
Read the idea PrincipleTreat a timeout as an unknown outcome
No response is not the same thing as no effect.
Read the idea ProtocolReconcile what changed after a bulk write
'Job finished' is a process status, not a data-quality result.
Read the idea ChecklistWrite invariants before the migration
A migration can be perfectly formatted and completely wrong.
Read the idea PrincipleShrink the change before shrinking the review
A giant change does not become small because the ticket fits on one screen.
Read the idea HeuristicLet the change bake before stacking the next one
If you change the experiment before the result arrives, you inherit an explanation problem.
Read the idea ChecklistVersion the configuration that changes behavior
If configuration can change production, it deserves a history as serious as code.
Read the idea ProtocolDetect configuration drift instead of assuming sameness
'Same deployment' does not guarantee the same state.
Read the idea ProtocolDry-run the real-shaped input without the real write
Real data can teach you something before it is allowed to change anything.
Read the idea ProtocolMake the rollout stop itself on a known bad signal
A safety metric is more useful when it can pull the brake.
Read the idea