Rolling out safely to production.
The gap between a deploy that works in staging and a deploy that survives a Friday afternoon is smaller than most teams think, but the shape of the gap changes as your traffic does. This piece is about how the Moon team closes it in production.
Every rollout carries three risks: a regression that the eval missed, a latency cliff that only surfaces under real load, and an operational stumble on either end. The techniques that follow reduce all three, in the order they matter.
Start with a routed 5 percent
The single most reliable safety mechanism we have found is to start every rollout at five percent of live traffic, held there long enough to see two things: the p95 latency curve settle, and the eval verdicts for the top five buckets clear.