Shipping code and enabling behavior are two different events, separated by a flag. A canary / percentage rollout turns a release from a binary event into a controlled experiment with a rollback metric. A kill switch is a separate kind of flag: not an experiment but a breaker built in advance for degradation (see 55); it lives forever and is tested regularly.
The term “progressive delivery” was coined by James Governor of RedMonk in 2018 for the practices that sit between continuous delivery and full release: canaries, percentage rollouts, flags, automated analysis of the rollout’s metrics. The vocabulary of flags comes from Pete Hodgson’s “Feature Toggles (aka Feature Flags)” on martinfowler.com (2017), which separates release toggles, experiment toggles, ops toggles and permission toggles by how long they live and how dynamic they are — the kill switch above is an ops toggle, and it is the one kind meant to stay.
// a typed flag, with owner and lifetime right in the declaration
@Flag(owner = "team-payments", removeBy = "2026-10-01", kind = RELEASE)
static final BoolFlag NEW_SETTLEMENT = flags.bool("settlement.v2", false);
if (NEW_SETTLEMENT.on(ctx.customerId())) { ... } // percentage by a stable hash of id,
// not random(), or the user
// flickers between versionsAn honest assessment. Flag debt is real: every flag means 2n configurations, of which two get tested. A removal date is part of the definition of done; a flag older than two quarters with no decision is a process incident. The consequence for schemas: a canary means two versions of the code are always live at the same time, so expand — migrate — contract (17) goes from “good practice” to the only option.
Why flag hygiene is not pedantry. The SEC’s 2013 order against Knight Capital describes how, in August 2012, new code reused a flag that had once activated a retired function; one of eight servers had not received the new code, the flag woke the old function there, and the firm lost about $460 million in 45 minutes. A reused flag is the same hazard as a reused field number (18): a name whose old meaning is still alive somewhere.
Where it does not fit. A canary needs enough traffic to tell a regression from noise: a service with a hundred requests an hour gets nothing statistically useful from 1 %, and a staged rollout by time is more honest. Database migrations cannot hide behind a flag at all; they are made safe by being backward compatible (17). And mobile or on-premise clients cannot be rolled back once installed, so for them the flag, not the deploy, is the only rollback there is.