A sixth reopening begins when post-retirement monitoring finds a material path outside the fifth-closure evidence. In the current case, WebP traffic enters a new region and one cache fleet omits the request dimension that distinguishes variants.
This guide shows how to quarantine only the unsupported WebP path, preserve request-to-byte evidence, prove that the origin and scientific product remain sound, repair cache-key construction, build adversarial canaries and close the sixth investigation on representative traffic.
The Gold Standard is containment that preserves diagnosis. A broad product rollback can hide a representation fault; an overly narrow purge can leave contaminated variants alive. The boundary must follow the actual negotiation and cache path.
A practical orientation
Keep resource, representation and product separate. The URL names a resource; the request selects a representation; the bytes encode a product version. A cache fault can mix representations while the remote-sensing array remains unchanged.
The worked example uses paired requests that warm adjacent WebP and AVIF variants. The regional cache reuses the wrong stored object. Quarantine and closure tests therefore exercise request order, Vary-based keys, freshness, validation and decoded science.
- Bound the sixth reopening — for owners containing the affected path.
- Quarantine WebP safely — for delivery and cache teams.
- Follow the paired-request test — for a complete diagnosis.
- Build closure evidence — for staged release and retirement.
- Transfer the method — for language or compression negotiation.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Quarantine the WebP path at a dependable boundary
Work the example
1. Translate the sixth-reopening gate into a path boundary
Define the affected client family, Accept pattern, WebP variant, third region, cache implementation, product classes and observation window. Keep JPEG, AVIF and other regions on their verified paths when request-to-byte evidence supports separation.
Preserve the fifth-closure reference, retired control and known-good canaries. The reopening asks why a new path mixes variants; it does not erase prior evidence for paths that still pass.
- Request fields and normalisation.
- Variant, region and cache fleet.
- Freshness and validator state.
- Product identifier and scientific checks.
- Quarantine, purge, rollback and closure authority.
2. Preserve request-to-byte evidence before purge
Capture the paired requests, cache lookup keys, hit state, stored metadata, Age, validators, content type, object identifiers, transformation versions and decoded arrays. Record the order because cross-variant contamination may depend on which request warmed the cache.
Do not purge first and reconstruct later. Purge protects users but can remove the only evidence showing whether the wrong object was selected, labelled or transformed. Capture enough safely, then contain.
3. Quarantine the WebP path at a dependable boundary
Disable WebP negotiation for the affected regional fleet or route those requests around it. If cache fleets cannot be distinguished reliably, broaden containment to the region. Keep unaffected variants and regions live only when their separation is verified.
Set response headers and cache directives for the fallback deliberately. A quarantine that changes content negotiation without updating cache variance can create a second contamination path.
| Boundary | Control | Limitation |
|---|---|---|
| Client feature | Stop WebP request | Not all clients update quickly |
| Edge cache fleet | Bypass or disable WebP | Fleet routing must be reliable |
| Region | Force known-good variant | Broader performance cost |
| Whole service | Disable negotiated variants | Highest disruption; use if separation fails |
4. Repair cache-key and stored-metadata construction
Ensure the cache key incorporates the request fields that select the representation, consistent with the response’s declared variance. Store the selected variant and content metadata together, and prevent a transformed object from being relabelled under another format.
Review normalisation. Two syntactically different Accept fields may be equivalent, while different preference orders can select different variants. The key algorithm must match origin selection rather than a convenient substring.
5. Build adversarial canaries around request order
Test isolated requests, WebP then AVIF, AVIF then WebP, conditional validation, stale reuse, purge propagation and concurrent warm-up. Include unsupported preferences and fallback behaviour. A single clean request cannot expose adjacency faults.
Run canaries from the affected region and client stack. Preserve a stable corpus for regression and add new cases without deleting the evidence that supported earlier retirements.
6. Worked example: paired WebP and AVIF requests
A WebP request warms the regional cache for a tile URL. An AVIF request with a different Accept order follows. Before repair, the cache returns the stored WebP object with an AVIF content type on one path. The origin trace independently selects the correct variants, and decoded scientific arrays agree with the source product when the right object is delivered.
After key repair and purge, 1,000 alternating pairs across fresh, stale and conditional states return the requested representation, correct content type and matching product provenance. The test is repeated under concurrency and in the neighbouring fleet to verify that configuration propagation is not local to one node.
| Test | Before repair | After repair |
|---|---|---|
| WebP then AVIF | Cross-variant reuse | Separate objects |
| AVIF then WebP | Intermittent mismatch | Separate objects |
| Conditional request | Wrong validator path | Variant-specific validation |
| Science comparison | Correct when right bytes decoded | Correct across both variants |
| Origin selection | Correct | Correct |
7. Prove the scientific product was not the failed layer
Compare product identifiers, geolocation, dimensions, band order, scale and offset, nodata handling and decoded values. If these agree for correctly delivered variants, the evidence locates failure in negotiation or caching rather than product generation.
Do not overstate equivalence for lossy display formats. Array or visual tolerances must match the product’s intended use, and metadata differences still require review even when pixels look similar.
8. Set sixth-closure evidence gates
Close only when key construction matches negotiation semantics, adversarial canaries pass across affected fleets, purge and propagation are verified, coverage includes current WebP traffic, scientific checks pass and the containment rollback has been exercised.
Require fresh evidence after repair. The requests that diagnosed the fault can demonstrate mechanism, but a later declared window should confirm stability under ordinary traffic and cache turnover.
- Mechanism reproduced and repaired.
- Variant-specific key and metadata verified.
- Order, freshness and validation canaries pass.
- Representative regional coverage restored.
- Scientific product checks pass.
- Rollback and post-closure monitoring assigned.
9. Release the quarantined path in stages
Begin with a small percentage of affected-region WebP requests while paired canaries and request-to-byte sampling run. Expand by fleet and product class, not only by aggregate volume, so a quiet path cannot remain untested.
Keep the forced known-good variant available until the observation window closes. If a protected mismatch returns, route the same path back to quarantine without disturbing verified regions.
10. Know the limits of cache and canary evidence
Synthetic pairs may not reproduce every intermediary, traffic race or transformation. Sampling can miss rare keys, and a green coverage percentage depends on how paths are partitioned. Report the unsupported remainder.
Decoded-array agreement does not validate every display characteristic, and correct bytes do not prove correct interpretation by clients. Keep delivery claims distinct from application and scientific-use claims.
11. Misconceptions, practical questions and transfer
Common mistakes include purging before capture, testing only one request order, assuming URL identity means representation identity, and rolling back the scientific product without product evidence. The repair is path-specific containment and adversarial request-to-byte proof.
Can the WebP path close if JPEG and AVIF were never affected?
Yes. Closure can be scoped to the repaired WebP region while earlier evidence continues to support the other variants.
Is one thousand passing pairs enough by itself?
No fixed count proves every path. The value depends on coverage, concurrency, cache turnover, regions and the declared uncertainty.
12. Changed-context evidence check and authoritative sources
Transfer the method to a JSON endpoint negotiating language and compression. Replace image decoding with schema, locale and decompression checks, while preserving request order, cache variance, freshness and representative coverage.
RFC 9110 defines HTTP resources, representations, fields and intermediaries. RFC 9111 defines caching, including Vary-based cache keys, freshness, validation and invalidation. Product-specific remote-sensing checks remain necessary beyond those protocol standards.
Continue through the Gold Standard ecosystem
Return to the Remote Sensing subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: post-fifth-retirement monitoring and sixth-reopening gates · Earlier guide: fifth-closure trials and negotiated-variant canaries · Remote Sensing root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.