A canary failure after fourth retirement does not justify reopening every cache, catalogue route and data product. It justifies a bounded fifth reopening around the request variants and delivery mechanisms that can reproduce the failure. Content negotiation makes that boundary easy to miss: two requests for one URL can legitimately receive different representations, while an incomplete cache key can incorrectly make one variant stand in for another.
This guide continues the post-fourth-retirement monitoring work. It shows how to define the fifth-reopening scope, capture and replay negotiated request paths through origin, edge and client, separate representation delivery faults from scientific-product identity, and close only when the relevant variants and cache states pass declared evidence gates.
The Gold Standard is point-of-use verification with preserved provenance. A clean origin response is not enough when a warm edge can serve the wrong encoding or media type. A delivery correction is not scientific validation either. Both questions matter, and they need different evidence.
A practical orientation
Keep four identities visible: the request variant, the HTTP representation, the remote-sensing product and the scientific use. Accept, Accept-Language, content coding and format parameters can change the representation without changing the product. A product version can change while the negotiated media type stays the same.
The worked example follows a warm-edge failure in which an AVIF-capable request primes a cache and a later client receives an unsuitable variant because the cache key does not respect negotiation. The fix belongs in representation selection and caching, not in the satellite product.
- Bound the fifth reopening — for incident owners defining scope.
- Build the negotiation matrix — for delivery and product teams.
- Follow the warm-edge example — for an end-to-end replay.
- Apply fifth-closure gates — for accountable restoration.
- Transfer to JSON and language variants — for changed APIs and clients.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Translate the fifth-reopening signal into a bounded delivery question
Build the evidence chain
Build a negotiation-path replay matrix
Work the example
Worked example: an AVIF variant contaminates a warm edge entry
Stress-test the decision
1. Translate the fifth-reopening signal into a bounded delivery question
Write the failure as a tuple: requested URL, method, relevant request fields, client capability, region, cache state, response status, response fields, delivered bytes and intended product identity. State which part was wrong. “The image failed” is not enough to distinguish a negotiation mismatch, stale cache entry, decoder limitation or incorrect product.
Freeze unrelated paths. If the signal concerns AVIF negotiation at one edge, do not simultaneously purge every catalogue cache, rewrite redirects and replace the source product. Preserve a known-good route for comparison and protect affected clients with a narrow fallback while evidence is gathered.
- Affected URLs, representations, clients, regions and cache states.
- Expected negotiation rule and product identity.
- Observed response fields, validators, bytes and client result.
- Known-good route, temporary restriction and rollback.
- Owners for origin, edge, client and scientific product.
2. Separate product identity from representation identity
A remote-sensing product may be identified by dataset, acquisition, processing level, version and asset. HTTP then selects a representation of that resource, possibly by media type, language, coding or explicit format parameter. Record both. A correct AVIF representation of the wrong processing version is still wrong; a correct GeoTIFF delivered with a misleading content type is also a fault.
Use product metadata, persistent identifiers or controlled catalogue fields for dataset lineage. Use request and response fields, validators and byte checks for delivery identity. Do not ask one layer of evidence to prove the other.
| Layer | Example identity | Primary evidence |
|---|---|---|
| Request variant | Accept, language, coding, format parameter | Captured request fields |
| HTTP representation | Media type, coding, validator, bytes | Response fields and digest |
| Remote-sensing product | Dataset, acquisition, processing version | Catalogue and provenance metadata |
| Scientific use | Fit for mapping or analysis question | Domain validation and method record |
3. Build a negotiation-path replay matrix
List the request dimensions that the server or cache actually uses: Accept values and quality weights, Accept-Language if meaningful, Accept-Encoding, explicit format query parameters, authentication or region, and client version. Pair them with cache states such as miss, warm hit, stale revalidation and post-update. The matrix should cover mechanisms, not every theoretical permutation.
Capture the raw request and response at the origin, edge and point of use. Include Vary, Content-Type, Content-Encoding, Content-Language where applicable, ETag, Last-Modified, Age, Cache-Control, redirect chain and final bytes. A replay is comparable only when these conditions are preserved or deliberately changed.
4. Diagnose origin, edge and client separately
First request each variant directly from the origin or controlled upstream. Then send the same sequence through the edge and finally through representative clients. If origin selection is correct but a warm edge serves the previous variant, examine cache-key construction and Vary handling. If delivery is correct but one client fails, inspect decoder support and local caching.
Order matters. A cache fault may appear only when one variant primes the entry before another requests it. Preserve the priming sequence and timing. Repeating the failing request after a broad purge can make the symptom disappear while leaving the mechanism untouched.
| Pattern | Likely layer | Next evidence |
|---|---|---|
| Origin chooses wrong media type | Negotiation logic | Selection rule and request parsing |
| Origin correct; warm edge wrong | Cache key or Vary | Priming sequence, key and stored response |
| Bytes correct; client cannot render | Client capability | Decoder, content coding and local cache |
| All delivery layers agree; dataset wrong | Product/catalogue | Version, asset and provenance trace |
5. Preserve cache state as evidence
Record whether each replay was a miss, hit, stale response or revalidation. Age and validator behaviour help, but they are not a universal provenance record. Where the platform exposes cache keys or trace identifiers, capture them without assuming that a vendor-specific header is authoritative by itself.
Avoid beginning with a global purge. A narrow bypass or quarantine can protect users while the failing object and sequence are preserved. After repair, deliberately test cold, warm and revalidated states so closure does not depend on the temporary cleanliness created by the investigation.
6. Worked example: an AVIF variant contaminates a warm edge entry
A catalogue thumbnail has JPEG and AVIF representations. The origin correctly selects AVIF when Accept prefers image/avif and JPEG when it does not. A warm edge entry, however, is keyed only by URL. An AVIF-capable browser primes the cache; a later field client without AVIF support receives the AVIF bytes with the AVIF content type and fails to display them.
The team captures six planned replays: two Accept profiles across cold miss, warm hit and post-revalidation states. Origin responses are correct in all six. Through the edge, only the JPEG-profile request after AVIF priming fails. The repair adds the negotiated dimension to the cache key and confirms appropriate Vary behaviour. No product version, processing level or thumbnail source changes.
| Accept profile | Cache state | Observed result | Interpretation |
|---|---|---|---|
| AVIF preferred | Cold miss | AVIF correct | Origin and fill correct |
| JPEG only | Cold miss | JPEG correct | Origin selection correct |
| AVIF preferred | Warm after JPEG | AVIF correct after repaired key | Variant separation works |
| JPEG only | Warm after AVIF | AVIF before repair; JPEG after | Cache-key defect isolated |
| AVIF preferred | Revalidated | AVIF with expected validator | Revalidation respects variant |
| JPEG only | Revalidated | JPEG with expected validator | Closure evidence complete |
7. Repair the mechanism and test the sequence that exposed it
Correct the negotiation or cache-key mechanism, invalidate only the affected entries where possible, then replay the original priming order. Verify response fields and bytes at the edge and point of use. A repair that passes only isolated cold requests has not addressed the observed failure mode.
Use shadow or non-user-facing traffic first, then a limited client and region cohort. Keep a known-good representation available and monitor fallback use. If the platform cannot express the required variant key reliably, restrict negotiation or use explicit variant URLs rather than claiming closure.
8. Set fifth-closure gates
Fifth closure requires the bounded negotiation matrix to pass at origin, edge and representative clients across meaningful cache states. Product identity and provenance must remain correct; monitoring and rollback must be active; and residual untested variants must be named. Closure may be partial when only one region, client family or representation has enough evidence.
Do not require impossible certainty, but do not collapse six distinct paths into one green request. The gate is a decision about the tested scope. A later new client or media type is a changed context that may require its own admission evidence.
- Affected variants reproduce before repair and pass after repair.
- Origin, edge and point-of-use evidence agree.
- Cold, warm and revalidation paths relevant to the incident are tested.
- Product identity, version and provenance remain intact.
- Limited release, monitoring and rollback succeed.
- Untested representations and clients remain restricted or explicitly governed.
9. Use partial closure when evidence is asymmetric
If JPEG and AVIF are verified but WebP remains untested, close the first two and keep the third disabled or quarantined. If one region uses a different cache implementation, do not borrow closure evidence without checking equivalent behaviour. Partial closure is often more honest and more useful than keeping every path closed or declaring everything fixed.
Document the boundary in catalogue and operational language that future teams can understand. Include the variant matrix, configuration version, test evidence and trigger for expanding scope.
10. Keep delivery assurance distinct from scientific fitness
Correct representation selection proves that the requested bytes reached the client under the tested conditions. It does not prove that the product is scientifically suitable for a new land-cover class, spatial scale, atmospheric condition or downstream model. Keep scientific validation and delivery-path assurance connected through product identity but evaluated by their own methods.
Similarly, a changed ETag does not necessarily mean the scientific product changed; compression or representation generation may alter bytes. Interpret validators within the server’s semantics and confirm product version through controlled metadata.
11. Misconceptions, practical questions and transfer
Common mistakes include assuming one URL has one representation, omitting request fields from incident evidence, purging before reproducing, treating Vary as magic without checking actual cache behaviour, and using a correct preview as proof of scientific fitness. The remedy is a small mechanism-linked replay matrix.
Does a Vary response field prove that every cache keys variants correctly?
No. It communicates which request fields influenced selection, but implementation and configuration still need end-to-end testing. Capture the actual warm-hit behaviour at the edge.
Must every possible Accept header be tested before closure?
No. Test the supported, material equivalence classes and the sequences that can reproduce the fault. Name unsupported or untested variants instead of implying universal coverage.
12. Changed-context evidence check and authoritative sources
Transfer the method to a JSON API that negotiates language and compression. Include Accept-Language and Accept-Encoding in the request identity, test a warm cache primed by another language, and verify the decoded JSON schema and product identifier at the client. Do not assume that a fresh response is the correct language or representation.
RFC 9110: HTTP Semantics defines representations, content negotiation, validators and Vary. RFC 9111: HTTP Caching defines cache storage, reuse, freshness and validation. These standards support the negotiation-path checks used here; the actual CDN configuration, catalogue lineage and client capabilities determine the local closure evidence.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: post-fourth-retirement monitoring and fifth-reopening gates · Earlier guide: fourth-closure release trials and fourth-retirement gates · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.