An eval set wired into release machinery as an automatic barrier: the change ships only if the bank of graded tasks still passes. The gate tests the failures you already imagined; the rest of the rollout ladder exists because reality imagines better (Chapters 16 and 20).