Ranking model rollout safety

Design the experimentation platform a search team uses to safely roll out new ranking models. They ship a new ranker every week, and a bad ranker hurts revenue and user trust immediately. You need to (a) detect within hours whether a new ranker is better or worse than the current one, (b) protect against a catastrophically bad model reaching all users, and (c) handle the fact that ranking quality is hard to measure with a single conversion metric. Design the rollout + evaluation system.