Shadow deployment: compare without serving v2

Current snapshot

Follow a pair, not a promotion

Each of twenty synthetic user turns has an integer input. The control returns twice that integer and its answer alone reaches the user. Mirrored turns run a second candidate calculation; those answers are retained only for comparison. The timeline admits one complete turn every three modeled seconds. This is an inspection schedule, not an HTTP traffic rate or a latency benchmark. Each row exposes the input-derived served result, candidate result or timeout, comparison decision and tool policy. No LLM, ADK runtime, provider or deployment endpoint is contacted. A good comparison does not promote the candidate.

Choose coverage and candidate behavior

Mirror coverage selects 25, 50 or 100 percent of this fixed twenty-turn fixture. Within every block of four requests, the first one, first two or all four are copied. The resulting counts are exactly five, ten and twenty. This deterministic selection is deliberately easy to audit, but is biased: writes occur on every fourth request, so only full coverage includes writes. Candidate behavior chooses identical arithmetic, an off-by-one error on odd request identifiers, or slow identical arithmetic. Under full coverage and a 200 ms deadline, identical arithmetic yields twenty matches, while the odd-request fault yields ten matches and ten mismatches. These are paired exact-output checks, not a semantic evaluator for natural-language answers.

Separate response disposal from tool safety

Every fourth control turn performs one intended synthetic write. Tool policy either quarantines the mirrored write or allows an extra write. Quarantine gives five intended control writes, five blocked candidate writes and zero duplicates at full coverage. Allow writes produces five duplicates even though no candidate answer was served to a user. Read tools return fixture stubs; quarantine does not run a real sandbox or intercept a real request. Discarding a response is not equivalent to suppressing a tool side effect. A production shadow environment needs explicit tool isolation and suitable handling of sensitive copied inputs.

Keep session state isolated

Session storage chooses Forked state or Shared production state. Forked state appends candidate history to a separate synthetic counter: after twenty mirrored turns there are twenty production turns and twenty shadow turns. Shared production state appends each candidate turn to the production history as well, giving forty production turns and twenty contaminating appends. The shadow counter records how many candidate turns ran, not an additional physical database. Subsequent arithmetic intentionally ignores history, so the page demonstrates contamination without inventing a downstream answer-quality measurement. Combining shared state with allowed writes exposes both independent hazards.

Inspect deadlines and a finite gate

The candidate takes a synthetic 120 ms normally or 300 ms when Slow is selected. Comparison deadline offers 100, 200 and 400 ms. A result slower than the deadline is unavailable for comparison and increments timeouts. With normal arithmetic and the 100 ms limit, there are twenty timeouts and zero completed pairs. Slow arithmetic with 400 ms gives twenty matches. Tool and session effects happen before this comparison deadline; a timed-out candidate can still have produced an extra write. Unsafe side effects take precedence in the gate, followed by mismatches or timeouts, then fewer than ten completed pairs. Otherwise the label says within fixture limits. None of these labels is a statistical confidence claim or a production release approval.

Control playback and save evidence

Play advances the sixty-second inspection and becomes Pause while running. Pause freezes the current request prefix. Next event pauses at the next request boundary. Restart preserves scenario settings and speed while rewinding. Time seeks and pauses; Speed selects quarter, half, normal or double pace. Editing a scenario rewinds without autoplay, and hiding the tab pauses. Export events JSON includes both the complete computed fixture and the currently inspected prefix, explicitly separated. Capture baseline stores the result and settings; Replace baseline updates it and Clear baseline removes it. Notebook observations persist in this browser and Export notes downloads them. Expand experiment and Exit full screen change the workspace view. The scrollable text history and snapshot expose all outcomes without relying on color.