Design a Safe Automated Retraining Pipeline

An ad click-through-rate model is retrained automatically every 6 hours on the last 7 days of impressions. Last month an automated retrain was promoted with a 4% higher offline AUC than the champion and caused a revenue drop; the postmortem found the training set had accidentally included the label column as a feature for one day.

1. Which gates should have stopped this promotion, and where in the pipeline do they belong?
2. Describe the champion/challenger evaluation you would require, including how you split data given that click behaviour drifts over time.
3. What must be versioned so that the bad promotion could be rolled back in one step, and what would rollback not have fixed?