Before any deployment begins, pre-flight checks verify: • The container image exists in the registry • The image has no critical CVEs (security scan) • The diff size is within safe limits • Required secrets are present in the target env • Deployment is not blocked by a freeze flag Failing here is cheap. Failing after deployment starts is not.