How would you ship a prompt change safely?

Offline evaluation and regression suite; behind a feature flag so turning it off is seconds, not a deploy; shadow on copies of traffic; a small canary compared with control on a few user-facing metrics; then ramp in steps.