Release Discipline Over AI Hype: Field Notes from Drupal Patches, KEVs, and Real Agent Workflows

import Tabs from ' @theme /Tabs'; import TabItem from ' @theme /TabItem'; import TOCInline from ' @theme /TOCInline'; This week had a clear pattern: strong teams are tightening release discipline while the market keeps shipping AI press releases at industrial scale. The useful signals were concrete: patch timelines, exploit catalogs, runtime improvements, and operator-grade testing patterns. The fluff was still fluff. Stop Calling It “Legacy,” Start Asking Better Questions “What’s the one area you’re afraid to touch?” “When’s the last time you deployed on a Friday?” “What broke in production in the last 90 days that wasn’t caught by tests?” — Ally Piechowski, How I audit a legacy Rails codebase Those questions expose system risk faster than another architecture diagram. Pair that with Simon Willison’s blunt point about agentic engineering : code is untrusted until executed. “Looks right” is not a test strategy. ⚠️ Caution: Release confidence is measurable Track “Friday deploy confidenc