Upgrades as non-events: the binary-swap contract
docker pull, restart, done — no schema migrations, no export/import, no upgrade runbook. The on-disk format is a stability promise, not an implementation detail.
Upgrade dread is learned behavior: operators have been burned by migrations that lock tables, version dances with required waypoints, and release notes whose 'breaking changes' section needs its own table of contents. The dread taxes everyone — teams running old versions out of fear are running old bugs out of fear.
Crowkis's upgrade contract is one move: pull the new image, restart the container. The on-disk format — WAL, SSTables, vector index, the lot — is stable across releases as a promise, not a coincidence; the new binary reads what the old one wrote and gets to work. No migration step exists to fail.
Four doors in, one cache, and the model only sees genuinely new questions.
The contract is enforced where promises become real: the release gate includes booting new builds against existing data and verifying the corpus serves identically. A release that would require a migration doesn't pass the gate, which means the question of whether this upgrade is 'one of the risky ones' has a standing answer: no.
The bottom line
Cheap upgrades change behavior: you track current, you get fixes the week they ship, and 'what version are we on?' stops being a forensic question. The best release process is the one nobody schedules a meeting for.