Every engineer who has ever shipped on a Friday has told themselves the same sentence: it's small. It's isolated. It's basically a config change. That sentence has cost more weekends than any outage report will ever admit.
This one was a feature flag default. A single boolean, flipped from false to true, in a service nobody had touched in eleven months. The tests passed because the tests only covered the false branch. The staging environment agreed, because staging shared a cache with nothing.
Outages are rarely caused by complex code. They're caused by simple code that nobody was watching.
Forty minutes after deploy, the checkout queue started backing up. Not failing — backing up. The worst kind of incident, because dashboards stay green while the business quietly stops.
Green dashboards are not the same as a working business.
We spent the first hour looking in the wrong place, as you always do. The change had been so small that nobody believed it could be the cause. The rollback took four minutes once we admitted it might be.
The real failure wasn't the boolean. It was that a team of eleven people had no shared answer to the question: who decides when we ship, and who is awake if it goes wrong?
