Property Import Rollbacks with a Node.js Feature Flag Kill Switch

In the context of a Node.js backend property import system, the implementation of a kill switch using a feature flag requires careful consideration. The goal is to ensure a smooth transition to a stable parser while handling potential issues that may arise during scheduled imports.

The recommended approach is to implement a small server-side gate that determines which parser variant should be used. This gate should cache the last valid flag snapshot and have a fallback mechanism that disables the new import path. The decision should prioritize rollback safety over keeping an experimental parser alive during a control-plane outage.

To handle various failure modes, it is crucial to separate the failure signals. The Node.js backend is responsible for parser selection and fallback defaults, while the scheduler manages the cadence of the imports. Domain validation determines whether the import made progress, rather than relying solely on an HTTP success counter.

The key signal to monitor is the progress of the scheduled import. Record relevant information such as the scheduled run ID, source watermark, accepted count, rejected count, completion time, and parser variant. This data can then be used to trigger alerts when an expected result is not observed, rather than simply detecting exceptions.

Google's four golden signals (latency, traffic, errors, and saturation) can serve as a boundary for the surrounding service. However, the import adds an additional domain signal - the freshness of accepted property data - which those four signals cannot infer. The import frequency (e.g., every 15 minutes) should dictate a maximum silence threshold (maxSilenceMs) that can be set based on real schedule, normal completion variance, and alert response time. This value should be tested with delayed and missing runs to ensure proper functionality.

When a failure occurs, the kill switch must be able to rollback while dependencies are failing. The first decision criterion is control independence - the kill switch should not rely on the failing parser, its datastore, or a live flag network call. It should be implemented within the process itself. To achieve this, cache a validated snapshot and provide operators with a narrowly scoped local override that can only select a known implementation. If no valid snapshot exists, fall back to the established parser and emit a state-change event.

To ensure reversibility under concurrency, read the flag only once at the start of a run and pin that decision to the run ID. This allows the current run to remain internally consistent, even if the evaluation changes halfway through a large file. The next run can then use the new decision, while the current run remains unaffected.