THE GOLD STANDARD OF INFORMATION · SPECIALIST STUDY
Prove that a promoted SPARQL plan remains safe after the canary window ends and temporary controls begin to disappear
Promotion changes the question. During a canary, treatment assignment, observation effort and rollback readiness are unusually visible. Afterwards, caches warm, tenants migrate, plan pins expire, statistics refresh, nodes restart and operators stop watching the same dashboard. A sound post-promotion programme follows requests across these transitions, detects treatment crossover, protects low-volume query shapes, distinguishes delayed plan harm from ordinary workload drift and retires surveillance only when the system can explain its steady state without the temporary safety net.
This guide belongs to the Information subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define the post-promotion population · chapters 1, 2, 3
Trace crossover and state changes · chapters 4, 5
Detect delayed harm · chapters 6, 7, 8
Expire controls and recover safely · chapters 9, 10, 11
Close surveillance with evidence · chapters 12, 13
The whole problem at a glance
| Question | Evidence needed | Unsafe shortcut |
|---|---|---|
| Which plan actually ran? | Request-to-plan lineage and node state | Release flag says promoted |
| Who crossed treatment? | Assignment, retry and cache history | Current cohort label |
| What changed after promotion? | Statistics, data, engine and load epochs | One aggregate trend |
| Can surveillance close? | Protected-shape and recovery evidence | No recent alert |
The decision unit is a request in a versioned operating state.
CHAPTER 1 OF 13 · Define the post-promotion population
1. Redefine the population after promotion
The canary cohort is no longer the whole decision unit once the candidate becomes the default. Define promoted requests, deliberately pinned baseline requests, excluded shapes, retries, shadow traffic, administrative probes and requests that cannot be attributed. Whole-endpoint averages can hide a protected query family that remained outside the canary or crossed plans during retry.
Evidence record: Store query-shape identifier, parameter band, tenant-safe stratum, assignment rule, observed plan fingerprint, node, dataset generation, engine build and result status for every sampled request. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Refuse a steady-state claim while meaningful traffic is unclassified or the protected population lacks an observation path. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Move from one endpoint to a routed federation; rebuild the population across local and remote execution boundaries. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Redefine the population after promotion”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Define the post-promotion population
2. Separate release intent from observed execution
A rollout flag expresses intent, not proof. Prepared plans, local caches, rolling nodes, stale configuration and fallback paths can continue serving the baseline or an older candidate after promotion. Surveillance must observe the executed algebra or physical fingerprint closely enough to attribute outcomes without enabling prohibitively expensive logging.
Evidence record: Version normalisation rules, raw diagnostic samples, fingerprints, configuration, cache generation, node acknowledgements and unknown-plan counts. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Escalate any unexplained fingerprint; do not relabel it as the promoted plan merely because deployment metadata says so. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An engine upgrade changes explain formatting; revalidate the fingerprint correspondence before joining historical observations. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Separate release intent from observed execution”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Define the post-promotion population
3. Set a surveillance horizon from mechanisms
A fixed seven-day watch may miss a monthly statistics refresh, quarterly data load or delayed pin expiry. Set observation horizons around state transitions that can plausibly alter plan choice or performance: restarts, index rebuilds, statistics epochs, dataset growth, cache eviction and traffic seasonality.
Evidence record: Keep a state calendar, expected transition dates, minimum protected-shape exposures, event-triggered extensions and the rationale for each time boundary. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Extend surveillance until each material mechanism has either been observed under safe coverage or explicitly carried into permanent monitoring. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A rare reporting query runs only at term end; use event coverage rather than elapsed days. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Set a surveillance horizon from mechanisms”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Trace crossover and state changes
4. Detect treatment crossover at request level
Crossover occurs when a request receives a plan different from its assigned or expected treatment. Retries may land on another node, pins may have narrower pattern matching than intended, and fallback logic may change the plan after a timeout. Current labels cannot reconstruct the plan that produced an earlier outcome.
Evidence record: Record expected and observed plan, assignment key, retry chain, node, cache state, pin match, fallback reason and any exclusion or manual override. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Report crossover as its own outcome, then analyse performance both by assigned treatment and by observed plan without presenting the latter as randomised evidence. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A retry changes parameters as well as node; treat it as a new request lineage rather than a simple crossover. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Detect treatment crossover at request level”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Trace crossover and state changes
5. Interpret crossover without causal overclaim
Post-promotion traffic is observational. Slow requests may be more likely to retry into the baseline, while operators may pin high-risk shapes selectively. Comparing observed-plan groups can therefore reverse cause and effect. Use the original canary for causal claims and post-promotion data for bounded safety and drift evidence unless a new assignment design supports more.
Evidence record: Preserve original assignment, reasons for pins and overrides, pre-request covariates, censoring, missing attribution and sensitivity analyses. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: State association when treatment selection is endogenous; trigger investigation from a safety signal without claiming the plan caused it. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A tenant is pinned because of a prior incident; stratify history rather than comparing it directly with ordinary promoted traffic. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Interpret crossover without causal overclaim”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Worked crossover ledger
| Window | Requests | Unexpected plan | Protected-shape breach |
|---|---|---|---|
| Promotion hour | 620 | 3 | 0 |
| Pin-expiry hour | 710 | 41 | 2 |
| Rollback hour | 680 | 18 | 1 |
| Stable follow-up | 2,940 | 0 | 0 |
A real ledger also needs denominators, plan fingerprints and reasons.
CHAPTER 6 OF 13 · Detect delayed harm
6. Watch protected shapes with exposure-based denominators
A rare query family can suffer two severe failures while the endpoint remains green. Define correctness, timeout, memory and latency floors for protected shapes, then count eligible exposures and unknown outcomes. Absence of executions is a coverage fact, not evidence of safety.
Evidence record: Retain shape definition, risk reason, exposure count, plan coverage, failures, censored requests, service floor, alert rule and review owner. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Do not close a protected-shape gate until its minimum exposure or an authorised alternative test has been met. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A protected shape disappears after a product change; prove decommissioning rather than treating zero traffic as successful surveillance. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Watch protected shapes with exposure-based denominators”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Detect delayed harm
7. Distinguish regression from workload and data drift
Latency can rise because cardinalities, parameters, graph distribution, concurrency or remote dependencies changed even when the plan did not. Conversely, a plan can silently change under stable workload. Decompose plan, data, query and infrastructure epochs before assigning cause.
Evidence record: Keep parameter summaries, cardinality estimates and actuals, statistics versions, dataset size, cache state, remote timing, resource pressure and plan fingerprint. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Open a regression case when harm follows a plan or state transition with a reproducible witness; otherwise preserve the competing explanations and test them. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A new named graph doubles one join input; rerun the plan comparison on the new data state rather than importing the old verdict. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Distinguish regression from workload and data drift”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Detect delayed harm
8. Look for rollback after-effects
Rollback can restore the baseline flag while leaving warmed candidate pages, stale prepared statements, mixed caches, queued work or node-specific overrides. Immediate recovery may therefore overstate or understate the baseline. Define a washout model and observe request-level plan lineage across it.
Evidence record: Record rollback command, propagation, cache invalidation, in-flight requests, node acknowledgements, plan observations, recovery curves and remaining candidate executions. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Close rollback only when the declared fleet and protected shapes meet baseline attribution and service checks after the required washout. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A cache clear creates a temporary latency spike; separate recovery cost from continuing candidate harm. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Look for rollback after-effects”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Expire controls and recover safely
9. Expire plan pins as controlled experiments
A pin is temporary debt. Before expiry, verify the underlying statistics, index, configuration or query repair; stage unpinning for a bounded shape set; and keep a rapid restoration route. Silent expiry can expose every dependent request at once, while indefinite renewal can freeze an obsolete plan.
Evidence record: Store owner, reason, matched shapes, compatible versions, start, expiry, renewal history, replacement evidence, unpin cohort and restoration rehearsal. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Block expiry when the repair is unverified; block renewal when no accountable path exists to remove the underlying cause. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An engine release removes the pinned operator; test a replacement before the compatibility boundary arrives. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Expire plan pins as controlled experiments”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Surveillance exit gate
| Gate | Close evidence | Keep open when |
|---|---|---|
| Attribution | Plan observed per request | Mixed or unknown execution |
| Protection | Rare shapes meet floors | Coverage or floor gap |
| Recovery | Rollback residue cleared | Stale nodes or cache effects |
| Durability | Checks survive state changes | Only one calm window |
Exit requires coverage, attribution and tested recovery.
CHAPTER 10 OF 13 · Expire controls and recover safely
10. Test surveillance through restarts and refreshes
Steady state should survive the events that rebuild optimiser decisions. Exercise a node restart, cache loss, statistics refresh or equivalent safe rehearsal while observing fingerprints, protected shapes and recovery. Otherwise surveillance may certify only one warmed configuration.
Evidence record: Preserve rehearsal scope, safety budget, before-and-after plans, statistics, cache markers, request outcomes, abort trigger and recovery evidence. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Promote a check into permanent monitoring when the state transition recurs after surveillance closes. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A managed service does not expose cache control; use naturally occurring restarts and record the observational limit. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Test surveillance through restarts and refreshes”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Expire controls and recover safely
11. Escalate with bounded rollback and forward-fix choices
Not every post-promotion signal requires fleet-wide rollback. A correct decision may quarantine one shape, repin a cohort, refresh statistics, repair an index or roll back globally. The choice should follow severity, attribution, blast radius, recoverability and the risk of the control itself.
Evidence record: Keep signal, confidence, affected population, mandatory floors, available actions, approval, execution, communication and verification window. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Use immediate containment for correctness or mandatory-floor breaches; otherwise select the smallest reversible action that protects users while evidence grows. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A global rollback would reintroduce a known security defect; use a shape-specific containment with explicit residual risk. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Escalate with bounded rollback and forward-fix choices”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Close surveillance with evidence
12. Convert temporary checks into durable monitoring
Canary dashboards often depend on high-cardinality labels or expensive explain logging that should not run forever. Before decommissioning, translate essential protections into sampled fingerprints, state-change alerts, protected-shape synthetic probes and incident-ready diagnostic escalation.
Evidence record: Map every temporary signal to a permanent control, owner, cost, retention, alert route, drill and known blind spot. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Do not remove the only mechanism that can attribute a protected failure; redesign it first. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Privacy rules shorten request telemetry retention; retain minimised lineage while preserving incident reconstruction. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Convert temporary checks into durable monitoring”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Close surveillance with evidence
13. Publish decommissioning evidence and residual limits
The closeout record should state what was promoted, which populations and state transitions were observed, crossover and unknown rates, protected-shape exposure, pin outcomes, rollback residue, incidents, permanent controls and untested limits. A clean summary without denominators cannot support future change.
Evidence record: Archive versioned plan definitions, observation windows, excluded traffic, incidents, decision minutes, pin closure, monitoring handover, retention and deletion receipts. Preserve timestamps, versions, denominators, exclusions, failed checks and rejected alternatives so a later reviewer can reconstruct the decision.
Decision rule: Close surveillance only when each unresolved item has an owner and durable path; reopen it when the tested envelope materially changes. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Transfer the method to a search-ranking canary, replacing SPARQL plan fields while preserving attribution, crossover and state-transition evidence. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Publish decommissioning evidence and residual limits”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Contents · Previous chapter · Return to the Information guide
Verification lab: work the decision twice
Build a fictional request ledger with assigned and observed plans across promotion, retry, pin expiry and rollback. Calculate crossover and unknown-plan rates by protected shape.
Introduce a statistics refresh and cache loss. Decide whether the observed tail regression follows the plan, the data state or both, and name the experiment that discriminates them.
Design the exit package: permanent monitors, pin closure, rollback washout, rare-shape evidence, residual blind spots and a trigger that reopens surveillance.
Limits and misconceptions
Promotion is not the end of treatment attribution
Mixed caches, nodes, retries and pins can preserve multiple plans.
Post-promotion comparisons are usually observational
Selective pins and retries can confound observed-plan outcomes.
No alerts does not prove protected coverage
Rare shapes need exposure denominators or authorised tests.
A rollback flag does not prove recovery
Confirm request-level execution after propagation and washout.
Questions readers ask
How long should plan surveillance continue?
- Until material state transitions and protected populations have defined coverage, not merely for a fixed number of quiet days.
What is treatment crossover?
- A request executing a plan different from its assigned or expected treatment.
Can observed-plan groups prove causation?
- Usually not after promotion because retries, pins and overrides are selected by operating conditions.
When should a pin expire?
- After the underlying cause is repaired, staged unpinning passes and restoration is rehearsed.
What closes rollback?
- Observed baseline execution and service recovery across the declared fleet and protected shapes.
What remains after surveillance?
- Durable attribution, state-change and protected-shape controls proportionate to risk.
Practise, verify and continue
Design post-promotion surveillance for five SPARQL shapes across rolling nodes, one temporary pin, a statistics refresh and a rollback drill. Include crossover, unknown-plan and protected-shape denominators.
Move the method to a database index canary. Preserve request attribution, state transitions, selected-treatment bias, bounded recovery and decommissioning evidence while replacing SPARQL algebra fields.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
SPARQL query-plan canary deployment
SPARQL cardinality-estimate drift alerts
SPARQL prepared queries and plan-cache invalidation
SPARQL configuration drift and mixed-version nodes
Authoritative sources and scope
Apache Jena guidance for explaining ARQ query algebra and execution
Apache Jena TDB optimiser, statistics and execution logging documentation
Eclipse RDF4J repository and query programming documentation
W3C SPARQL 1.2 Query Language
Apache Jena, RDF4J and W3C sources support plan explanation, optimiser state and SPARQL semantics. They do not prescribe this post-promotion surveillance framework. The crossover ledger is fictional; production controls, privacy, engine capabilities, thresholds and retention must be verified for the exact deployment.