What matters is not that it never fails, but how it fails.

If sessions cannot be verified nobody is treated as signed in rather than everyone: the public site keeps working and the protected routes turn everyone away. If a limit cannot be checked, the order is not sent — doubt is resolved against execution, not in its favour.

Production does not confirm receipt when a request cannot be stored. The visitor receives a retry message. Contact or financial-profile data is not copied into runtime logs as a substitute for database storage.

The status page checks configuration and database connectivity on demand. Its mail indicator confirms provider configuration only, not delivery to a recipient's inbox.

Every deploy is built from a specific commit and can be rolled back to. No change reaches production outside that path.