A release process where the old version is only retired after the new one is verified on the public domain.
PM2 · Caddy · PowerShell
Stopping the app to rebuild it produced a 30–60 second window of 502 errors on every release.
Two loopback-only slots. The new release builds into its own directory, starts on the idle port, passes health checks, and only then does Caddy switch over with a graceful reload. The public domain is verified before the old slot is retired; a one-command rollback restores the previous release.
