# Fail-closed transactional release closure

Use this checklist when a release changes classification, import preview, ledger, or other transactional behavior while writes remain approval-gated.

## Candidate and review discipline

1. Freeze one candidate and run an independent tracked-source review against the exact base.
2. Rank findings P0/P1/P2. Fix every release-blocking finding in a small vertical change with a regression test.
3. Verify the fixes directly, then run one complete canonical gate (`make verify` or repository equivalent). Do not weaken, skip, or xfail tests.
4. If an exact-SHA post-merge audit finds a P1, close it through a separate narrow PR: regression test, full gate, clean CI, normal merge, and redeploy the new merge SHA. Do not silently patch the deployed worktree.

## Publication and CI

- Stage only intended tracked files; run diff, privacy, secret, and repository-safety checks before commit.
- Prefer normal PR merges. Treat a provider's clean mergeability state plus successful normal merge as CI evidence when the token cannot read detailed check-run APIs; record the permission boundary rather than misreporting CI failure.
- Re-fetch remote main and prove that remote main, merge result, deployment worktree, and reported SHA are identical.

## Runtime deployment verification

- Back up the production datastore before deployment and restore that backup into an isolated file. Compare integrity, FK findings, table counts, and a logical digest.
- Install from the exact merge. Immediately import a version marker and inspect the resolved module path. An apparently successful editable install is not proof that the runtime imports the new code; if resolution remains stale, install a wheel/non-editable package and verify again before restart.
- Restart only affected services, wait for readiness, and check both process state and HTTP health.
- Run responsive UAT at desktop, tablet, and phone widths. Check horizontal overflow, intended grid collapse, touch-target size, relevant copy, and browser console errors.

## Read-only production preview

- After every classification or import-rule change, rerun the full real-file preview against the final deployed merge SHA—even when an earlier candidate preview passed.
- Open the DB read-only and fingerprint source files before/after. Record table counts/digests, integrity, FK findings, import-table counts, errors, and explicit `confirm_called=false` / `real_import_performed=false` evidence in private `0600` artifacts.
- Compare candidate and deployed outputs. Any mismatch must be explained before closure.
- Keep private transactions, names, source hashes, raw responses, backups, and database copies outside Git.

## Closure semantics

Separate two conclusions explicitly:

- **Software release complete:** review findings fixed, full gates green, CI clean, normal merge, exact SHA deployed, backup/restore and UAT proven.
- **Business Confirm readiness:** independently derived from coverage/review thresholds. `business_ready_for_confirm=false` is a valid fail-closed release outcome and means Confirm/Realimport remain prohibited.

Report preview runtime as an operational observation when it is material; do not hide a long-running preview merely because it eventually exits successfully.