A sixth closure proves that the WebP cache-key fault has been repaired under declared tests. Retirement asks a harder question: can the containment be removed while real traffic, cache turnover and regional variation continue to preserve the correct request-to-byte path?
This guide designs a staged release trial. It keeps the known-good fallback executable, uses canaries that vary request order, freshness and validation, samples product provenance and decoded values, and retires quarantine only when representative WebP paths pass for a full observation window.
The Gold Standard is reversible retirement. Performance recovery matters, but it never outranks representation correctness or scientific provenance.
A practical orientation
Treat each delivery as a chain: request preferences, origin selection, cache key, stored object, response metadata, decoded representation and scientific product. A canary should identify which link fails, not merely whether an image appears.
The worked example releases WebP to 5%, 25%, 50% and 100% of the repaired regional fleet. An early stale-validation mismatch pauses expansion, reveals one node with old key normalisation and prevents premature retirement.
- Define the release trial — for delivery and product owners.
- Design WebP canaries — for cache and test teams.
- Follow the staged example — for a complete numerical trial.
- Apply retirement gates — for removing containment safely.
- Transfer the method — for another format or endpoint.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Build canaries that vary request order and state
Work the example
Stress-test the decision
1. Write the sixth-closure release-trial contract
Record the repaired key algorithm, Vary fields, WebP selection rules, affected region and fleets, product classes, cache states, fallback variant, purge state, canary corpus, scientific checks, rollout steps and observation window. Retirement is evaluated against this contract.
Keep JPEG, AVIF and unaffected regions as references where their evidence remains current. The trial changes only the repaired WebP path and its declared dependencies.
- Request fields and normalisation rules.
- Cache fleets, regions and software versions.
- Fresh, stale, conditional and purge states.
- Object, response and scientific-product checks.
- Stage thresholds, pause rules and rollback owner.
2. Separate protocol, byte and scientific gates
Protocol evidence checks status, Content-Type, Content-Encoding, Vary, Age, validators and cache result. Byte evidence checks object identity and representation signature. Scientific evidence checks product identifier, geolocation, dimensions, scale, nodata and decoded values against the source.
A correct Content-Type with the wrong object is a failure. Correct WebP bytes with the wrong product are also a failure. Passing one layer cannot substitute for the next.
| Layer | Primary check | Failure example |
|---|---|---|
| Protocol | Headers and cache semantics | Missing selecting field in Vary |
| Representation | Object and format identity | WebP label on AVIF bytes |
| Product | Provenance and metadata | Wrong tile or processing version |
| Science | Decoded values or visual tolerance | Scale, nodata or value mismatch |
3. Build canaries that vary request order and state
Use isolated WebP requests, WebP then AVIF, AVIF then WebP, repeated WebP, missing Accept, weighted preferences, conditional requests, stale reuse, purge propagation and concurrent warm-up. Run both cache hits and misses.
Give each canary a known expected object, headers and product. Preserve request and response traces with fleet identity. A canary that checks only status 200 cannot reveal cross-variant reuse.
4. Choose representative release cells
Partition the trial by cache fleet, region, client family, product class, request state and traffic period. Select cells that exercise the repaired mechanism, not merely the largest aggregate volume. Rare stale-validation and cold-cache cells deserve explicit quotas.
Report coverage as a matrix. A 99% pass rate can hide one untested fleet or one path with repeated failures. Expansion should depend on cell-level gates and enough cache turnover to exercise replacement.
5. Keep the fallback and rollback observable
The forced known-good variant should remain executable at every stage. Record which requests use fallback, why, and whether fallback itself preserves product and cache semantics. Exercise rollback before wider release.
Do not interpret low rollback usage as proof that rollback works. A controlled drill should show routing, cache invalidation and client recovery within the declared time.
6. Worked example: staged WebP release with a pause
At 5%, 2,000 paired canaries and 18,000 sampled requests pass fresh-hit, miss and ordinary validation checks. At 25%, one of eight cache nodes returns a stale WebP object under an AVIF request after revalidation. The stage pauses automatically. Trace evidence shows that node retained an older Accept-normalisation library despite the key configuration update.
The node is removed, upgraded and its cache purged. The team repeats the 25% stage across two turnover cycles, then advances to 50% and 100%. Across 160,000 sampled deliveries, every release cell returns the expected representation and product provenance; decoded science checks pass within declared format tolerances.
| Stage | Evidence | Decision |
|---|---|---|
| 5% | All declared cells pass | Advance |
| 25% first run | One stale-validation mismatch | Pause and repair |
| 25% repeat | Two turnover cycles pass | Advance |
| 50% | Representative fleet and product cells pass | Advance |
| 100% | Full observation window passes | Evaluate retirement |
7. Diagnose a canary failure before resuming
Freeze the exact request order, node, stored metadata, key inputs, validator path and object identifiers. Determine whether failure comes from origin selection, key calculation, stale reuse, transformation, propagation or client interpretation.
Repair the earliest failing layer and repeat the failed cell plus neighbouring cells. Do not restart only the aggregate counter; a stage resumes when the mechanism-specific evidence is fresh.
8. Set sixth-retirement gates
Retire quarantine only when every declared release cell has passed, the repair is deployed across all eligible fleets, cache turnover and revalidation have been exercised, rollback works, scientific provenance checks pass and a post-retirement monitor has an owner.
If a low-volume path lacks evidence, keep that path on fallback or declare it unsupported. Partial retirement is safer and more accurate than treating aggregate success as universal.
- Origin selection and Vary semantics match.
- Variant-specific cache keys and validators verified.
- Order, freshness, concurrency and purge canaries pass.
- Representative client, fleet and product cells covered.
- Product provenance and scientific checks pass.
- Rollback exercised and post-retirement triggers assigned.
9. Retire controls without deleting their evidence
Remove forced fallback in stages, but retain the configuration, canary corpus, failed trace, repair version and release matrix. Preserve the ability to re-enable quarantine quickly if a protected mismatch recurs.
Retirement should simplify the live path, not erase why the guard existed. Future engineers need to know which selecting fields, cache states and fleets were required to reproduce the sixth reopening.
10. Know the limits of release-trial evidence
Synthetic canaries may not cover every intermediary, client bug or traffic race. Sampling can miss rare keys. Format tolerances depend on intended use, and visual agreement cannot prove numerical equivalence for quantitative products.
A full observation window supports the declared traffic and cache turnover, not every future software version. Keep version-aware monitoring and explicit reopening triggers after retirement.
11. Misconceptions, practical questions and transfer
Common mistakes include advancing on an aggregate pass rate, testing only fresh hits, dropping fallback before rollback is exercised and treating correct pictures as complete scientific evidence. The repair is cell-based request-to-byte proof.
Must one failed node cancel the whole release?
It should pause the affected stage until the mechanism and neighbouring scope are understood. Unaffected regions can remain live when separation is reliable.
Does WebP retirement mean every representation path is certified?
No. It certifies the declared WebP scope and supporting references. Other formats and future versions retain their own evidence requirements.
12. Changed-context evidence check and authoritative sources
Transfer the trial to a compressed GeoJSON endpoint that negotiates encoding and language. Replace image decoding with decompression, schema and locale checks while preserving request order, cache variance, validators, representative cells and rollback.
RFC 9110 defines content negotiation and the Vary field used to describe selecting request fields. RFC 9111 defines cache keys, freshness, validation and invalidation. These standards support protocol checks; product provenance and remote-sensing science require additional domain evidence.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: sixth-reopening containment and WebP-path quarantine · Earlier guide: fifth-closure release trials and negotiated-variant canaries · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.