| Backup retention — the floor you cannot prune through | 102 | a state machine, a memory invariant, try / catch |
| Blue/green cutover — there is no state where nobody serves traffic | 114 | a state machine, a memory invariant, try / catch |
| Cert rotation — expiry is an escalation ladder, not a surprise | 108 | a state machine, a memory invariant, try / catch |
| Db migration — applied migrations are immutable history | 104 | a state machine, a memory invariant, try / catch |
| Deploy canary — the staged rollout you cannot skip | 102 | a state machine, a memory invariant, try / catch |
| Dns change control — no record goes live without passing validation | 102 | a state machine, a memory invariant, try / catch |
| Kill switch — a dead flag stays dead | 105 | a state machine, a memory invariant, try / catch |
| Fleet sync — no activation until every node runs the same code | 100 | a state machine, a memory invariant, try / catch |
| Image promotion — nothing unscanned, unsigned, or vulnerable ships | 105 | a state machine, a memory invariant, try / catch |
| Incident ladder — severity only climbs, and closure needs a postmortem | 118 | a state machine, a memory invariant, try / catch |
| Pager escalation — no page resolves without a human acknowledging it | 110 | a state machine, a memory invariant, try / catch |
| Rate limiter — admission control with a quota the memory enforces | 119 | a state machine, a memory invariant, try / catch |
| Secret rotation — a revoked credential never logs in again | 115 | a state machine, a memory invariant, try / catch |
| State lock — two concurrent applies can never both hold the lock | 114 | a state machine, a memory invariant, try / catch |