We were proud of the canary. Five percent of traffic for fifteen minutes, automated analysis comparing error rate and p95 latency against the baseline pods, promote or roll back with no human in the loop. It had caught four bad releases in six months. Then it promoted a release that corrupted nine hours of the nightly settlement run, and the canary's verdict had been green with wide margins. The release changed how a shared serialiser handled a nullable decimal. The synchronous API almost nev...