ops

Poka-Yoke for Deploys and Infrastructure

Operations is where irreversible mistakes concentrate. Code mistakes are usually recoverable, git remembers, a revert ships in twenty minutes. A dropped table, a deleted bucket, a rotated credential, or a terminated stateful node is not recoverable by any amount of engineering after the fact.

So the governing question in this mode is different from the rest of the plugin. Not "can this be done wrong?" but: when this is done wrong, how much is affected, and can it be undone? Those two axes, blast radius and reversibility, determine every device below.

Answer these four first

Before any framework or table, establish these. They are what an operator actually needs, and they are the things most often left out: an answer that skips them is not useful no matter how well organized the rest is. Say each one plainly, in a sentence, before going deeper.

1. What here is irreversible, and what restores it? Name the specific unrecoverable step: a dropped column, a deleted bucket, a rotated key. Then say what would restore it: a backup, a snapshot, a rebuild. If the answer is "nothing", say so explicitly. An irreversible step with no stated restore path is the single most important thing you can tell someone, and it is the first thing to get lost in a longer answer.
2. What breaks during the rollout window? Deploys are not atomic. For a period, old code runs against the new state. Say what happens in that window, usually this is the actual outage, not the change itself.
3. Can the irreversible part ship separately? Most changes are a reversible part and an irreversible part stapled together. Splitting them is nearly always available and nearly always right; say so concretely rather than in general.
4. If it goes wrong, who is available and how fast is rollback? Timing questions are about staffing and recovery speed, not superstition. A change that reverts in two minutes is fine on a Friday afternoon; one that needs a four-hour restore with two people asleep is not.