Fourth closure proves that a reopened representation-path defect was contained, repaired and tested under declared conditions. It does not prove that full traffic, every client variant and the next product update will preserve that result. Release therefore needs a staged trial, not a switch from quarantine to trust.
This guide continues fourth-reopening containment. It shows how to build semantic canaries for each affected representation class, expand exposure through meaningful cache and update cycles and decide when the fourth quarantine can be retired without deleting the recovery path.
The unit of evidence remains the path users experience: dataset identity, request variant, resolver and redirect chain, cache key, edge, validators and delivered bytes.
A practical orientation
Keep closure, release and retirement as separate decisions. Closure repairs the incident, release tests ordinary traffic and retirement removes a recovery control only after the replacement has proved itself.
The worked example releases JPEG 2000 delivery across two edge templates while GeoTIFF and tiles remain live. The transfer check adds a client that negotiates compression differently.
- Define the release candidate — for incident and product owners.
- Build semantic canaries — for delivery teams.
- Follow the edge rollout — for a complete staged trial.
- Apply retirement gates — for quarantine decisions.
- Transfer to a new client — for changed negotiation.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Build canaries that verify meaning, not just uptime
Work the example
Stress-test the decision
Choose retirement, partial retirement or continued quarantine
1. Define exactly what fourth closure repaired
Record the diagnosed mechanism, affected representation classes, repaired cache or routing configuration, product versions, tested edges, client headers, update cycle and residual exclusions. These facts define the release candidate.
Do not extend closure evidence to untested regions, formats or clients by similarity alone. Name the equivalence classes and the shared mechanism that justifies representative testing.
- Dataset and processing-version identity.
- Request headers and negotiated representation.
- Resolver, redirect, edge, cache and origin path.
- Freshness, validator and update behavior.
- Quarantine route, rollback authority and retained reference.
2. Separate staged release from quarantine retirement
A staged release returns bounded traffic to the repaired path while quarantine and rollback remain ready. Retirement removes or deactivates the quarantine after evidence shows that the ordinary path and its canaries can protect the service.
Conflating the two decisions creates pressure to delete the recovery route as soon as a canary passes. Keep the quarantine versioned, owned and tested throughout the trial.
| State | Traffic | Recovery control | Evidence purpose |
|---|---|---|---|
| Quarantine | Affected path blocked or diverted | Active | Contain exposure |
| Canary release | Synthetic or tiny representative share | Active | Test mechanism |
| Staged release | Increasing bounded share | Active | Test ordinary variation |
| Retired | Ordinary traffic | Archived or replacement-protected | Sustain verified service |
3. Build canaries that verify meaning, not just uptime
A semantic canary checks the intended product identity, spatial and temporal extent, processing version, representation, checksum or stable sample, validators and downstream interpretation. A 200 response only proves that something answered.
Choose canaries for each meaningful path class: warm and cold cache, updated and unchanged products, alternate edges, redirects, client headers and any format that shared the failure mechanism.
4. Exercise freshness, validation and representation selection
Test fresh reuse, expiry, conditional validation and a real product update. Capture Date, Age, ETag, Last-Modified, Cache-Control, Vary and the selected Content-Type or encoding where relevant.
A clean request after purge is weak evidence. The defect may return only when a cached response becomes stale, a representation changes or an intermediary collapses requests.
| Canary | Mechanism exercised | Pass evidence |
|---|---|---|
| Warm unchanged product | Allowed cache reuse | Correct identity and age |
| Expired product | Revalidation | Validator and current bytes agree |
| New processing version | Invalidation and key identity | New version reaches every class |
| Alternate Accept header | Content negotiation and Vary | Correct representation selected |
5. Expand exposure by mechanism coverage
Increase traffic only after the current stage covers the events that could recreate the defect. Use regions, client classes and representation paths chosen for mechanism diversity, not merely percentage milestones.
Set immediate stop rules for wrong identity, stale post-update delivery, validator inconsistency or material downstream consequence. A stage can pause for missing evidence without being called a failure.
6. Worked example: two JPEG 2000 edge templates
Fourth closure repaired a cache key that omitted a representation-specific update token. The release begins with synthetic JPEG 2000 canaries at the two edge templates that had served stale products, while verified GeoTIFF and tile paths continue under existing monitors.
The canaries pass warm, expired and post-update cycles. Traffic then rises from 1 percent to 10 percent and 50 percent across both templates. One client sends a different Accept-Encoding header; the representation remains correct because Vary and the cache key cover that dimension.
| Stage | Coverage | Observed evidence | Decision |
|---|---|---|---|
| Synthetic | Two templates; warm and cold | Identity and validators pass | Open 1% |
| 1% | Representative clients | No mismatch; rollback ready | Open 10% |
| 10% | Real update and expiry | New version reaches both templates | Open 50% |
| 50% | Alternate encoding client | Representation and Vary pass | Open full with heightened monitoring |
| Full | Two complete update cycles | No recurrence; canary coverage current | Consider retirement |
7. Keep rollback fast and evidence-preserving
Automate or rehearse a return to quarantine without destroying the failed response. Capture headers, bytes, request context, edge and configuration version before purge or diversion whenever consequence permits.
A rollback that takes hours of manual discovery is not ready. Test authority, route activation and user communication at each major release stage.
8. Set fourth-retirement gates
Retirement requires correct identity across affected classes, observed update and validation cycles, representative client coverage, bounded downstream consequence, durable monitoring, active ownership and a tested replacement for rapid containment.
Retire only the quarantine scope whose evidence passes. Keep unrepresented regions, clients or formats under continued control rather than using an all-or-nothing ceremony.
- Every affected representation class has a semantic canary.
- Update, expiry, validation and rollback cycles pass.
- Live traffic confirms the synthetic evidence.
- Coverage changes trigger review before deployment.
- A replacement containment route is owned and tested.
9. Choose retirement, partial retirement or continued quarantine
Retire when every declared gate passes and recovery capability survives. Partially retire verified paths while retaining quarantine for a bounded class. Continue quarantine when identity, exposure or mechanism remains uncertain.
Record residual limits and the next review event. Dormant configuration without an owner is not a recovery capability, even if it remains in version control.
10. Monitor after retirement without freezing the coverage map
Keep semantic canaries in ordinary monitoring and compare live request variants with the coverage matrix. A new edge, format, client or caching policy can make yesterday’s canary suite incomplete.
Use coverage drift as a deployment gate. The right response to an unrepresented material path is to add evidence or restrict rollout, not to assume that the retired quarantine proved every future representation.
11. Misconceptions and practical questions
A successful purge is not a release trial, a correct origin is not proof of public delivery and a large traffic share does not replace mechanism coverage. Retirement concerns recovery capability as well as current correctness.
Must every possible client be tested before retirement?
No. Define defensible equivalence classes and representative tests. Keep materially different or unrepresented clients restricted until their path is evidenced.
Can the quarantine configuration be deleted after retirement?
Only if a tested replacement provides the same or better containment and rollback function. Preserve the incident evidence and a rapid recovery path even when the exact temporary rule is archived.
12. Changed-context transfer, evidence check and sources
Transfer the method to a new client that negotiates Brotli compression. Add the Accept-Encoding dimension to the coverage map, verify Vary and cache-key behavior, compare identity after a product update and stage rollout before treating it as equivalent to existing clients.
RFC 9110 defines HTTP representations, validators and content negotiation. RFC 9111 defines cache freshness and validation. These standards support path testing; remote-sensing provenance and fitness for use still require dataset-specific evidence.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: fourth-reopening containment and fourth-closure evidence · Earlier guide: post-third-retirement monitoring and fourth-reopening gates · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.