A dial, not a switch: staging a risky migration with hash-bucket cohorts
A boolean feature flag starts a risky migration everywhere at once. Hashing a stable tenant ID into 100 buckets turns the flag into a dial that only ever widens, and the thresholds matter: percent-of-tenants is not percent-of-work.