Courts are rolling out a new clerk LLM on Kubernetes while most replicas must stay on the proven build. Which serving practice best limits blast radius?

Courts rolling out a new clerk LLM on Kubernetes need a serving practice that keeps most replicas on the proven build while exercising the new image under real load. Canarying a new Docker image tag on a small replica subset—while the stable tag remains on the majority of pods—limits blast radius: only a fraction of court kiosk traffic hits the unproven clerk model, and operators can halt promotion if error rates, latency, or answer-quality gates fail. That pattern matches progressive delivery for municipal GenAI where clerk downtime or wrong legal guidance is high cost. Replacing every replica with the untested image in one simultaneous rollout is a big-bang cutover; a single bad model or broken tokenizer then takes down every court kiosk at once. Deleting the stable tag from the registry before any canary traffic starts removes the rollback artifact—operators cannot retarget pods to the last good build if the canary misbehaves. Skipping container tags and rebuilding images only after a citywide outage inverts risk management: tags exist so courts can pin, canary, and roll back before residents feel a full outage. Exam caveat: canary sizing and success criteria (p95 latency, HTTP error rate, empty-response rate, or rubric scores) must be defined before traffic splits; a canary without gates is just a slower blast radius. Operational check: confirm distinct stable and candidate image tags in the registry, verify the Deployment or service mesh routes only a small percentage of clerk traffic to the canary pods, watch canary versus baseline metrics for a fixed soak window, and keep the stable tag pullable for immediate rollback of court replicas.