The booking system chose the worst morning of the term to fail. It was day one of check-ride week, the dispatcher’s screen showed slots that no longer existed, and the fix — a “quick patch” someone pushed at 6:40 — had quietly rewritten how the calendar displayed cancellations for every student at once. Nobody had decided that. The patch installed, therefore it released, and two hundred students became the test audience. Our small software crew at the school spent that week writing the six steps below, which we later recognised as a home-grown version of ReleaseOps, the release-strategy territory the Ops Atlas maps between the people who build releases and the people who govern them. Its first rule: installing a version and exposing behaviour to users are different acts, and each deserves its own decision.
What ReleaseOps means before step one
Two words carry the whole practice. Deploy: a version is installed somewhere, inert until observed. Release: behaviour becomes reachable by users. Aviation people will recognise the pattern from maintenance — an aircraft can return from the shop with a signed-off modification and still not be dispatched to students until the chief instructor approves it for training use. The shop did the install; the approval did the release. Nobody at the airfield would accept any looser arrangement, yet software teams accept it weekly, then act astonished when a Friday patch reaches every user before any human has watched it fly once. Software that fuses the two turns every patch into a fleet-wide test flight with no solo stage, which is how check-ride week became our forced curriculum.
The six steps
Step 1: Define your terms on one page
Write what deploy means at your school and what release means, and get the dispatcher, the chief instructor and whoever pays the hosting bill to initial the page. The document sounds ceremonial until the first argument, when it becomes the tiebreaker. Ours adds one sentence that pays rent repeatedly: if a change alters what a student or instructor can see or do, it is a release, whatever directory it lives in. That clause quietly pulled configuration edits, pricing tweaks and a well-meaning banner into the same governed lane as code.
Step 2: Draw your two dials
Sketch which lever controls installs (the version running in each place) and which controls exposure (who encounters which behaviour). At most schools the second lever does not exist yet — every audience change requires a code change — and drawing the gap honestly is the step. A flag works the exposure lever alone; canary and blue-green set-ups grip both levers in the same motion. Nobody buys all of this in week one — the step is mapping the territory honestly before walking it.
Step 3: Install dark before anyone looks
Push the version in silence first. A dark deployment lands on production infrastructure while exposure stays switched off, which means the install alone is no longer news. Systems keep running old behaviour while the new code sits behind the curtain, warming up. Our calendar patch would have sat invisible on the server while the dispatcher kept her morning — and while we compared its behaviour against the old version at leisure.
Step 4: Order your ways back
Decide the exits before entering. Killing a flag comes first because it acts in seconds, though it cannot reach a fault living outside the flagged path. Reverting the install comes second. Rolling forward comes last, and only down the route already staged — a detour around scrutiny is how small faults become announced ones. Then rehearse once on a staging copy, because an undo procedure that has never been flown is a hope wearing a checklist’s clothes.
Step 5: Expose gradually and watch the comparison
Open the behaviour to a sliver — one desk, one course, one percent of sessions — and read the difference against the untouched majority. Keep the comparison honest by resisting the urge to change two things at once; a rollout that varies three variables teaches nothing about any of them. Gradual exposure is really a measurement technique: it needs enough comparison traffic before the numbers mean anything, so match the audience you open to the question you are asking. A quiet booking widget cannot answer big statistical questions; a busy search endpoint can. Instructors will recognise the logic of a first supervised solo before a cross-country.
Step 6: Give the rhythm ninety days
Month one: the definitions page plus an inventory of every behaviour switch, each with an owner and a retirement date. Month two: one dark install and one rehearsed rollback. Month three: gradual exposure running on a real service, with the opening schedule written down and reviewed. Ninety days sounds slow until you notice most schools spend longer choosing a scheduling vendor. The Atlas packages the same arc as its 30/60/90 plan, and it holds for a two-person crew as surely as for a platform firm — small teams may simply keep every element lighter.
ReleaseOps in the hangar: what changes afterwards
Three things surprised us. The dispatcher stopped fearing Fridays, because exposure became a Tuesday-morning decision made by someone watching the screen. Our engine-tracking dashboard stopped lying during rollouts, since mixed versions no longer surprised it mid-window — a relief anyone who has studied engine behaviour for aviation coursework will appreciate, because instruments misread in transitions. Half-installed states are where gauges lie, in hangars and in clusters alike. And the crew argument moved from “who broke it” to “who saw it first”, which is the entire cultural prize. The Atlas’s own material goes further than our six steps — mechanism trade-offs, governance, the maths of sizing a gradual rollout — and we keep the guide to ReleaseOps from the Ops Atlas bookmarked beside the scheduling runbook.
If the vocabulary here overlaps with reliability engineering, that is no accident; the disciplines share a grandfather. Newcomers on our crew started with the practical route into site reliability engineering, and the cockpit walkthrough for new learners remains our favourite explanation for why staged procedures exist at all: you learn the panels before the panels carry lives.
Check-ride week ended, the calendar recovered, and the patch that started it all eventually shipped the boring way — dark, flagged, exposed to one desk, then ten, then everyone. Six steps. No drama. The way shipping should feel when the people depending on it have somewhere to be at seven in the morning, holding a headset, waiting for the schedule they were promised.
