Deployment freezes and risk budgets

For an event-based availability objective, identify eligible events, the good-event definition, and the reporting window. The allowed bad events are the eligible count multiplied by one minus the target good fraction. A request-based budget differs from a time-based downtime allowance and can weight users differently. Preserve that distinction when discussing an incident. A denominator that quietly excludes failing requests or changes with instrumentation can make a depleted service appear healthy without improving any user outcome.

Subtract observed bad events to track remaining accounting room, including an explicit overspend when it goes negative. Historical accounting is different from forecasting future traffic or a release's incremental harm. A fixed-window policy can behave differently near a boundary than a rolling window. The organization should define which releases pause at which threshold, which corrective work continues, and how to handle incomplete telemetry. The policy should be understandable before an incident creates pressure to invent a more convenient interpretation.

A staged release can estimate additional bad events from exposure and a plausible increase in error probability. That estimate depends on comparable populations, the exposure forecast, and a valid outcome definition. Rare severe failures, correlated users, shared dependencies, and data corruption may not fit a simple independent-event cost. Some changes should have hard guardrails regardless of the average budget remaining. A proposal should state uncertainty and a maximum permitted exposure rather than claiming that an expected two thousand errors can never become more.

A freeze can target routine new artifact promotions while allowing rollback, a compatible emergency fix, or infrastructure work required to recover reliability. Define a scoped exception with an owner, artifact/configuration identity, reason, expiry, guardrails, and recorded decision. Argo CD sync windows provide scheduling controls and configured override behavior, but they do not automatically encode an organization's full incident policy. Test that an intended recovery action remains possible and that an exception cannot silently become a permanent global bypass.

Specify how the freeze ends: sufficient service recovery, reliable telemetry, completion of a corrective action, or another documented policy condition. A calendar timeout alone may restore routine delivery before the failure mechanism is understood. Conversely, an indefinite freeze can accumulate a large batch of changes that becomes harder to assess when released together. Keep changes reviewable, preserve test execution and artifact preparation where policy allows, and restart exposure in controlled increments. The purpose is to manage service risk while retaining a usable recovery system.

In the probability lab, Reset, set both p=0.1 and n=20, predict two bad events on average, then Play or Step. Separately Reset, set both p=0.01 and n=20, predict 0.2, then Play or Step. Exact binomial probabilities show that an expectation can be fractional even though observed counts are integers. These independent equal-probability trials do not model a service budget, correlated outages, or a freeze policy. Explain why expected impact should be accompanied by uncertainty and guardrails rather than treated as a guaranteed spending limit.