The policy said a burnt budget triggers a deploy freeze; the budget was burnt by one incident and the freeze would have blocked the fix.
month: 99.5% objective, 3.6 hours of budget
incident on the 9th: 2.8 hours
remaining: 48 minutes
the policy as written: freeze deploys until the window
resets.
the policy as amended: a burnt budget requires that the
NEXT change be a reliability change, and requires the
reason to be written down. it does not stop deploys.A freeze assumes the deploys are the cause, which is true often enough to be a reasonable default and was not true here — the incident was a provider outage. The amended version keeps the pressure the budget is supposed to create and does not create a rule everybody has to argue their way past, which is what an unamended one becomes.