A web request that fails can be retried. A call cannot. Someone is holding the line right now, and the moment something in the pipeline throws, what they get is silence. So the pipeline was designed not as working-or-erroring but as a system with levels it can step down through.
A flag is a level
There are more than a hundred feature flags in the pipeline. Most of them are not there to turn a capability on and off — they are there to decide how far down to step when conditions get worse. Stepping the capability down and holding the call is the default; ending the call is not.
Used as a switch
On or off — when something breaks, the call is over
Used as a level
Continues one step down — the call stays up
Roughly 120 feature flags let the pipeline step down a capability when something is uncertain — risky paths default off, and the system holds the call instead of ending it.
Degrade over crash — The default behaviour of the realtime voice pipeline
Default off
It comes up once it is observable
A new capability is not born switched on. It arrives off, and comes up only once you can see what signal it leaves on a call. Reverse that order and it is already affecting calls before anyone can tell what went wrong.
If we do not know, the answer is no
The rule that matters most: unverified state is never read optimistically. If a state cannot be verified, that path fails closed. A person is the only gate to production, and a guard wrapper refuses a deploy that would drop a live function.
Off
In the code, affecting no call at all
Observed
Leaving signal, so what it does is visible
Partly open
On in a narrow scope, checked against real calls
Default
The standard path, with the step-down still in place
The order capability opens in
If a flag is a level, so is the rollout. This is the order we actually walk, and the point of every stage is that you can still go back from it.
- Merge it off — the code lands and no call changes.
- Read the per-call signal first. Those figures run the system; they are not benchmarks.
- Turn it on in a narrow scope. Most of the problems show up here.
- Never make it the default with the step-down removed — leave somewhere to go down to.
- What is open gets written down in the changelog and the roadmap.
More resources
Handling failure, and preparing the call flow itself.