A WAF rule tuned for the main hostname still blocks the canary path

A canary environment behind the same WAF behaves differently even after the rule was tuned against production traffic.