Canary Deployment

1. The Incident

Version 1.43 did everything right by the last lesson's book: deployed to green, health-gated, smoke-tested against production infrastructure, warmed, verified. The swing went out at 14:00, clean.

At 14:08, support is on fire. The bug: checkout fails for users who have a saved payment method and a non-US locale: a combination no smoke test exercised, because no smoke test knew about it. That's 3% of traffic: and the swing gave the bug 100% of that 3% instantly: thousands of failed checkouts in eight minutes before the swing-back.