The rewrite gets production's traffic; users get production

You're rewriting the pricing service. The rewrite looks done. You don't trust it yet.

A hook in front of the current service does two things per request: forwards to the live upstream as always, and fires a copy at the rewrite in its own container, logging the two responses when they differ. Users keep getting the old service's answers. The rewrite gets the old service's traffic: all of it, with the malformed coupons and the currency edge cases no test suite invented.

Three weeks, four hundred diffs, every one found in private. The cutover is boring, which was the goal.

The rewrite fails in private, on real traffic, weeks before it could fail in public.