The maintenance window was the bigger outage
We wanted to know what a maintenance window really costs a Magento store, against the alternative. Our deploy playbook takes one whenever a release has database work to do: every web server switches to the new code at once, the store shows its maintenance page while setup:upgrade runs, and then it comes back. The alternative is harder than it sounds. A rolling release, a canary or a zero-downtime deploy all need two versions of the code serving from one database at the same time, and Magento pushes back on that in three layers. It refuses pages when a module’s version doesn’t match the database. It refuses requests when the deployed configuration doesn’t match the imported one. And nothing at all protects a query that meets a schema it doesn’t match. A flag, deployment/blue_green/enabled, switches off the first two. Nothing switches off the third. ...