Third retirement removes a temporary quarantine or canary control after staged promotion has passed. The risk now is not only recurrence on an old path. It is that the live delivery surface changes while the retained canary suite continues testing yesterday’s regions, formats, cache keys and clients.
This guide focuses on coverage drift: the growing difference between what the canaries exercise and what users or downstream systems actually request. It sets a monitoring method and fourth-reopening gates for imagery, tiles, catalogues and derived-product APIs.
A healthy canary proves only the path and representation it actually tested. Coverage claims must be reconstructed whenever products, regions, negotiation rules or intermediaries change.
A practical orientation
Keep dataset identity, representation, request variant, delivery path and user consequence linked. A new format or edge region can create a fresh path even when the catalogue identifier stays the same.
The worked example introduces a JPEG 2000 representation and an Asia edge region after retirement, then distinguishes a coverage gap from a confirmed recurrence.
- Define the retired baseline — for incident and product owners.
- Measure canary coverage — for delivery teams.
- Follow the new-format example — for a complete diagnosis.
- Apply fourth-reopening gates — for governed response.
- Transfer to new regions — for changed delivery surfaces.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Work the example
Stress-test the decision
1. Record what third retirement covered
List the dataset identities, representations, regions, resolver and redirect paths, cache states, clients, update cycles and rollback drills that passed before retirement. This is the verified coverage envelope.
Name retained controls and untested edges. Retirement removes routine dependence on the quarantine; it should not erase the evidence or the capability to re-activate a safe route.
- Dataset and processing-version identity.
- Request headers and negotiated representation.
- Resolver, redirect, CDN and origin path.
- Cache freshness and validator states.
- Client, region, update and deployment cycles.
2. Monitor delivered meaning, not only reachability
A successful status code can return a stale, substituted or wrong representation. Verify identifier, spatial-temporal extent, processing level, checksum or semantic sample, and relevant HTTP freshness evidence at the point of use.
Connect technical checks to consequence. A thumbnail mismatch and a scientific raster mismatch may have different exposure even when both reveal the same cache-key defect.
| Layer | Canary evidence | Missed by uptime alone |
|---|---|---|
| Identity | Product and version match | Substitution |
| Representation | Media type, encoding and variant | Wrong negotiated form |
| Freshness | Age, validator and revalidation | Stale response |
| Path | Resolver, redirect, edge and origin trace | Unexpected intermediary |
| Consequence | Rendered or sampled result | Operational harm |
3. Define canary-coverage drift
Coverage drift is a material difference between the live request/path surface and the canary suite. It can arise from a new region, client, representation, redirect, cache policy, dataset update cadence or downstream transformation.
Measure both request share and consequence. A rare scientific export may deserve a canary even when a high-volume preview format already dominates the traffic sample.
4. Build a coverage matrix from live evidence
Inventory meaningful request variants and paths from logs, catalogues, deployment records and product changes. Map each to a canary, its last successful cycle and the semantic assertion it performs.
Do not treat provider-specific cache headers as universal truth. Combine path evidence with an identity or content assertion and document what each signal can establish.
| Dimension | Live variant | Canary question |
|---|---|---|
| Format | GeoTIFF, JPEG 2000, tiles | Is each representation identified and checked? |
| Region | Origin and edge regions | Does the tested path match live routing? |
| Freshness | Warm, expired, revalidated, updated | Are cache states deliberately exercised? |
| Client | Browser, API, batch job | Are request headers and cache keys represented? |
5. Trigger review when the live surface changes
Open a coverage review on a new representation, edge region, redirect, cache-key rule, major client, dataset update process or delivery provider. Also monitor for live variants with no recent canary result.
A coverage review is not automatically an incident. It asks whether the retired evidence envelope still represents the live system and whether targeted canaries can close the gap before consequence appears.
6. Worked example: a new format and edge region
After third retirement, a service adds JPEG 2000 output and routes Asia traffic through a new edge. Existing canaries continue checking GeoTIFF from the original region. They remain green while a batch client receives an old JPEG 2000 object after an update.
Origin and GeoTIFF responses are correct. The new edge reuses the JPEG 2000 response because the variant was absent from the old coverage matrix. The event demonstrates coverage drift and a live freshness defect; it does not prove that every retired path has recurred.
| Variant | Existing canary | Observed result | Conclusion |
|---|---|---|---|
| GeoTIFF / original edge | Covered | Correct | Old evidence still holds here |
| JPEG 2000 / original edge | Not covered | Correct on direct test | Coverage gap |
| GeoTIFF / Asia edge | Not covered | Correct | Path newly unverified |
| JPEG 2000 / Asia edge | Not covered | Stale after update | Confirmed scoped defect |
7. Contain the scoped defect without erasing evidence
Quarantine or bypass the affected format-region path, preserve response bytes, request headers, validators, redirect chain and intended identity, and compare with a controlled origin reference.
Avoid indiscriminate purges before capture. A broad purge may restore service while destroying the cache state needed to explain the defect. Expand containment only when evidence shows broader exposure.
8. Set fourth-reopening gates
Reopen the retirement decision when a material defect recurs, coverage drift exposes an unbounded surface, identity cannot be established, or the retained rollback path cannot protect affected users.
A bounded new variant can enter targeted repair and canary promotion without reopening every retired path. Match the scope of the fourth reopening to the evidence.
- Live variant lies outside verified coverage.
- Identity, freshness or representation is materially wrong.
- Consequence or exposure cannot be bounded locally.
- The same mechanism recurs after tested repair.
- A safe targeted path or rollback is unavailable.
9. Repair coverage as well as the immediate cache rule
Correct the variant and cache-key mechanism, then add semantic canaries for the new format, region and update cycle. Test warm reuse, update, expiry, validation and rollback rather than repeating one clean request.
Update the coverage matrix and retirement record. A repair that leaves the canary suite unchanged invites the same blind spot to return.
10. Keep delivery assurance separate from scientific fitness
Correct bytes and metadata do not prove that the product is suitable for a new classification question, scale or atmospheric condition. Delivery assurance protects identity and transport; scientific validation protects interpretation.
Conversely, a delivery defect should not be hidden inside a scientific uncertainty label. Name the path and representation failure so the repair can be tested.
11. Misconceptions and practical questions
A green canary is not global proof, traffic share is not the same as consequence, and a new region is not merely a duplicate path. Coverage must follow the dimensions that can change representation or behavior.
Must every request have its own canary?
No. Group requests by meaningful equivalence classes, then justify that each canary exercises the path, representation and cache behavior shared by its class.
Does a new uncovered variant require fourth reopening?
It requires coverage review. Reopening becomes appropriate when the gap exposes material or unbounded risk, a confirmed defect, recurrence or inadequate containment.
12. Changed-context transfer, evidence check and sources
Transfer the method to a new edge region. Before routing production traffic, sample the region’s resolver, redirects, cache states and negotiated formats; compare identity with origin; then add the region to ongoing coverage accounting.
RFC 9111 defines HTTP cache freshness and validation behavior. RFC 9110 defines representations, validators and content negotiation. These standards support the delivery checks used here; dataset provenance and scientific fitness still require domain evidence.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: cross-path quarantine release, promotion canaries and third retirement · Earlier guide: quarantine-retirement surveillance and third-reopening gates · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.