Canary accuracy must use independent labels

A canary heartbeat should grade model accuracy only against labels produced independently of the canary. Requests that fall back to the control path still matter operationally, but including them in accuracy can reward the fallback rather than the candidate. Track fallback rate, timeout rate, overload, and latency as separate gates; exclude control-served results from candidate accuracy. Withhold a good heartbeat when the eligible sample is too small or stale.

Applies when: A rollout advances automatically from aggregate quality and reliability signals. Keywords: canary heartbeat independent labels fallback accuracy rollout evaluation