Zero-downtime Node deploys on EC2 only work when health, traffic shift, and rollback share one definition of ready. Prefer bringing the new instance to a passing readiness probe before removing the old target, drain in-flight connections with a bounded wait, and keep the previous AMI or process tree bootable until error budgets clear. Treat a green build artifact as necessary but not sufficient — the cutover gate should be live request success, not a CI badge alone.

Ops prove-out after wiring the pipeline: roll a canary host under peak-like load and confirm the balancer only sends traffic after readiness passes, then abort mid-roll and confirm traffic returns to the prior healthy set without dual-serving broken builds. Watch 5xx share, connection reset rate, and deploy duration for one release window — rising resets with flat health usually means drain was shorter than the longest in-flight handler. Keep one untouched host on the prior revision beside the new fleet so you can tell a bad artifact from a balancer misconfig.