The feature team is responsible for ensuring their in-progress work is sufficiently tested. This usually means that all their tests are run from the beginning of the features life. So, we don't end up testing every combination of features, but instead the union of all features.

With good software design practices we don't usually find bugs that only occur with some specific non-total combination of features. But of course it does happen.

The article isn't a way to make provably correct software; it's a way to keep the wheels on a massive, fast-moving project -- barely :).

Sure, which is why I'm interested - I work on a massive, fast-moving (proprietary) project, and team and feature branches are a vital part of the workflow, and merges seem less costly than the risks of feature flags.

(Of course, the Knight incident being fresh in our minds, our assessment of those risks might not be entirely objective)