Database updates no longer fail a change just because others landed at the same time

Every change that touches the database runs a database update before it goes live. When several changes were ready at once, those updates could cancel each other: a change was marked as failed without its update ever running, and someone had to look into a failure that wasn’t real.

Updates now queue on the database itself and run one at a time, in the test environment and in production alike. A change is marked as failed only when its own update fails. If an update waits more than 20 minutes for the one ahead of it, it stops and names the update it was waiting on.

Production updates still need their usual approval, one release at a time.