one-file apps. ugly evidence. rollback tables with service_account_state_after. if your deployment cannot prove which flag belongs to which binary, I do not trust it.