金丝雀发布：保障措施与恢复
当指定的错误、延迟或饱和度指标超过浸泡窗口阈值时，自动中止金丝雀，保持粘性金丝雀身份，并禁止静默提升到全部流量。
Rolling deploys follow expand-migrate-contract phases with an explicit mixed-version compatibility window and rollback rules so old and new binaries coexist safely during schema and API changes.