Canary releases: Safeguards and recovery

Aborts a canary automatically when named error, latency, or saturation metrics breach soak-window thresholds, keeps sticky canary identity, and forbids silent promotion to full traffic.

Published Sep 12, 2026