A notification service should treat a feature flag as a rollback control, not as a second deployment system. For a delivery failure, the useful path is: see the failure page, identify the flag and cohort, read current state through an API, then move traffic back in a measured step. That keeps recovery reversible while the team works out whether the fault is code, a provider, or a bad audience rule.

The recommendation is to keep flag evaluation modular in Node.js, make flag state API-driven, and use a three-stage rollout with an explicit stop condition. A managed flag service can reduce code you own; a library such as unleash-client can keep evaluation close to the application; a plain REST surface can consolidate the flag call with other backend calls behind one key and one bill. None of those choices removes rollback ownership.

What does the on-call need to see first?

Start at the page that fires.…