Ten years, one legacy app, four deployment generations — from CodeDeploy to blue/green to fully-baked AMIs with instance refresh, and what each rebuild taught me.

A public postmortem: four upstream repo failures in one week, an emergency AMI, and a 16-second health-check race that routed traffic to half-deployed servers.

Porting container image layering to EC2 AMIs after the incident — weekly-baked layers, failure isolation, and a php-fpm health gate.

Five latent logic bombs found in my own blue/green deploy script, and why they slept for four years.

A deployment system is a pointer plus convergence: SSM Parameter Store as the release pointer, instance refresh as the loop, rollback without CI.

Rollback as a designed feature: deploy-gate alarms, auto vs manual boundaries, an incident mode that bypasses its own gates, and drills.

Real measured numbers for ASG instance refresh at different fleet sizes, and the capacity-adaptive strategy those numbers forced.

Patching when you never patch servers: three correctness features that blocked the patch path, the repave operation they forced, and measured numbers for the weekly and emergency patch trains.