The Knight Capital detail that stands out is that the rollback on the seven healthy servers actually spread the old Power Peg behavior further. One habit that has helped me is a post-deploy check that compares the running build hash on every instance against the expected one and fails the pipeline if any host differs, since a half-finished rollout is exactly what that catches. For canaries, I also like defining the abort thresholds (error rate, p99 latency) before the release starts. How do you decide the initial canary percentage when traffic is low?