A Failed Canary Must Block Stable Promotion
Success evidence loses meaning if failed or rolled-back assignments are ignored during promotion.
canary
STABLE Should Mean a Device Actually Ran the Release
A release should not become stable merely because an administrator clicked a promotion button.
Canary Checks Should Protect Unrelated Critical Services Too
A successful target deployment is not a full success if the change quietly damages another workload on the same host.
Canary and Stable Are Different Release States
A release that works on one device should not silently become the fleet default.