Retiring a fifth-closure control means the ordinary negotiation path again carries the service. It does not mean the retired control and its evidence can be forgotten. New clients, regions, formats and cache implementations can move traffic beyond the canary set that supported retirement.
This guide continues the negotiated-variant release work. It shows how to monitor the post-retirement path, measure canary coverage rather than only canary success, separate product faults from HTTP representation and cache behaviour, and reopen a bounded sixth investigation when the evidence surface changes.
The Gold Standard is a claim matched to coverage. Passing JPEG and AVIF canaries proves only the paths those canaries exercise. A growing WebP population or new regional cache can create an unsupported boundary even while every old canary stays green.
A practical orientation
Treat the delivered object as a negotiated representation: request fields, selected variant, cache key, freshness state, validators, transformation path, response metadata, bytes and scientific product version. Preserve all of them before blaming the sensor product.
The worked example follows a WebP rollout in a new region. Existing JPEG and AVIF canaries pass, but their coverage falls from 94% to 61% of eligible requests. One regional cache omits the new Accept-derived key dimension, producing cross-variant reuse. The underlying remote-sensing product is unchanged.
- Freeze the retirement record — for owners preserving the fifth-closure evidence.
- Measure variant coverage — for delivery and observability teams.
- Follow the WebP example — for a complete cache-path diagnosis.
- Apply sixth-reopening gates — for bounded control and investigation.
- Transfer to another API — for language or compression variants.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Work the example
Worked example: WebP rollout exposes a regional cache-key gap
Stress-test the decision
1. Freeze the fifth-retirement record and rollback state
Preserve the retired control, fifth-closure candidate, request corpus, negotiated variants, cache configuration, canary definitions, regions, product versions, evidence windows and retirement authority. Keep the control deployable until the agreed observation period ends.
Record what retirement did not prove. If the trials covered JPEG and AVIF in two regions with two cache implementations, they did not automatically cover WebP, a third region or a new transformation service.
- Request headers and normalised negotiation inputs.
- Variant and product identifiers.
- Cache key, freshness, validator and transformation settings.
- Canary population and traffic coverage.
- Protected scientific checks and rollback conditions.
- Observation period and sixth-reopening owner.
2. Monitor path health and scientific meaning separately
Delivery monitoring checks status, selected representation, cache behaviour, content type, dimensions, length and byte identity where stable. Scientific monitoring checks geolocation, band order, scale and offset, nodata handling, value ranges and product provenance. Keep both because a delivery fault can preserve plausible pixels, while a product fault can travel through a perfect cache.
Compare the same underlying product across variants when possible. If decoded arrays agree but bytes differ as expected by format, the evidence supports representation equivalence rather than byte identity.
| Layer | Evidence | Fault class |
|---|---|---|
| Negotiation | Request and selected variant | Wrong representation choice |
| Cache | Key, age, validators and reuse | Cross-request contamination |
| Bytes | Content type, length and decoding | Transformation or transport |
| Science | Array, geolocation and provenance | Product or interpretation |
3. Measure variant-coverage drift
Coverage is the share of eligible traffic represented by current canaries across client families, Accept patterns, formats, regions, cache implementations and product classes. Track both request-weighted and distinct-path coverage; one popular path can hide many untested rare paths.
Coverage drift occurs when traffic moves toward paths that the retirement evidence did not exercise. A green canary has not failed, but its relevance has narrowed. Define coverage floors and refresh triggers before the rollout so the team does not reinterpret them after an incident.
| Dimension | Example partition | Drift signal |
|---|---|---|
| Client | Browser, mobile SDK, analyst tool | New family exceeds threshold |
| Accept pattern | JPEG, AVIF, WebP preferences | Untested ordering grows |
| Region | Origin and cache fleet | New implementation enters traffic |
| Product | Tile, preview, analysis array | Canary misses affected class |
4. Keep canaries representative and adversarial
A useful canary exercises the real negotiation and cache path with controlled requests. Include positive cases, unsupported preferences, changed ordering, conditional requests and adjacent variants that should not share a cache entry. Run from the regions and client stacks that matter.
Refresh canaries when traffic or infrastructure changes, but keep old canaries for regression history. Replacing the set without lineage can make coverage appear stable while removing the only test of a retired risk.
5. Diagnose drift with request-to-byte traces
For a sampled request, preserve normalised negotiation fields, cache lookup key, hit or miss, stored variant metadata, response fields, object identifier, transformation version and decoded scientific checks. The trace should show why this representation was selected and whether the cache reused the correct object.
Do not infer cache semantics from the URL alone. A resource can have multiple representations, and the cache must incorporate the request fields that select among them when the response declares that variance.
6. Worked example: WebP rollout exposes a regional cache-key gap
A new mobile client prefers WebP and launches first in a third region. JPEG and AVIF canaries remain green, but together represent only 61% of eligible traffic, down from 94%. Users in the new region intermittently receive AVIF bytes with a WebP content type after an adjacent request warms the cache.
Request-to-byte traces show that the origin selects correctly and the remote-sensing product version, geolocation and decoded values are unchanged. The regional cache implementation keys on the URL but omits the relevant Accept-derived dimension. The team disables WebP only in that region, purges affected entries, preserves the traces and reopens the representation-path investigation.
| Evidence | Finding | Conclusion |
|---|---|---|
| Old canaries | JPEG and AVIF pass | Known paths remain healthy |
| Coverage | Falls to 61% | Retirement evidence no longer representative |
| Origin trace | Correct WebP selection | Origin negotiation is sound |
| Regional cache | Variant dimension omitted | Cross-variant reuse fault |
| Science checks | Arrays and provenance agree | No product-change evidence |
7. Contain the changed path without rewriting the product
Restrict the new variant and cache fleet that form the unsupported boundary. Keep other regions and known variants on the post-retirement path when their evidence remains valid. A whole-service rollback may be necessary if cache separation is uncertain, but it should be labelled as precautionary scope.
Purge only after preserving key and object evidence needed for diagnosis. Confirm that purge and configuration propagation reach every affected cache before reopening the path.
8. Set sixth-reopening gates
Reopen when coverage falls below the declared floor, an untested variant or cache implementation becomes material, canaries no longer represent traffic, a cross-variant response is observed or protected scientific checks fail without a simpler explanation. Name the request, region, cache and product scope.
The gate admits a bounded investigation and staged trial, not an assumption that the fifth-closure conclusion was wrong everywhere. Preserve the retired control and fifth-closure reference so the new path can be compared without losing the verified state.
- Coverage drift is measured with declared denominators.
- Request and response evidence identifies the unsupported path.
- Origin, cache, transformation and product alternatives are tested.
- Immediate containment protects affected requests.
- Fifth-closure reference and rollback remain executable.
- Fresh canaries and confirmation window are assigned.
9. Rebuild canary coverage before another retirement decision
Add WebP ordering, regional cache and conditional-request cases to the corpus. Test cross-variant adjacency deliberately, because isolated requests may never expose key contamination. Confirm purge, freshness and validator behaviour under repeated and mixed requests.
Require coverage recovery as well as passing cases. A larger canary suite can still be weak if it exercises only a small share of real paths. Report which dimensions remain unsupported.
10. State the limits of delivery and scientific evidence
A passing decoded-array check may miss metadata, colour-management or lossy-display effects, while byte inequality can be perfectly normal across formats. Synthetic traffic may not reproduce production intermediaries, ordering or load. State what the comparison can and cannot exclude.
Cache traces can also be incomplete when multiple layers add Age, validators or transformations. Preserve hop-specific evidence where available and avoid assigning the fault to the nearest visible cache without tracing the chain.
11. Misconceptions, practical questions and transfer
Common mistakes include treating green canaries as complete coverage, equating URL identity with representation identity, purging before preserving evidence and blaming the remote-sensing product for a content-negotiation fault. The repair is coverage-aware request-to-byte tracing.
Does a coverage-floor breach prove users received wrong data?
No. It proves that the retirement evidence no longer represents enough traffic. Reopening is justified so the new path can be tested before a delivery fault becomes an unsupported risk.
Must every new image format trigger a full rollback?
No. Contain the new format or fleet when the boundary is reliable. Roll back more broadly only when representation separation or propagation cannot be trusted.
12. Changed-context evidence check and authoritative sources
Transfer the method to a JSON API that negotiates language and compression. Replace image decoding checks with schema, locale and decompression checks, while keeping request selection, cache keys, coverage and variant adjacency. The mechanics transfer because the evidence follows representations, not because every format is an image.
RFC 9110 defines HTTP semantics, including resources, representations, fields and intermediaries. RFC 9111 defines HTTP caching, including cache keys with Vary, freshness, validation and invalidation. These standards support the delivery analysis; product-specific scientific checks remain essential.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: fifth-closure trials, negotiated-variant canaries and fifth-retirement gates · Earlier guide: fifth-reopening scope and fifth-closure gates · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.