# Bootstrap Safety Rollout Gates

## Required Regression Tests

Run these before staging deployment:

```bash
cd backend
go test ./cmd/server ./internal/bootstrap ./internal/infrastructure/persistence
```

Targeted safety tests introduced by this change:

- `TestBatchCreatePhysicalTables_PreservesTablesOnRegisterFailure`
- `TestCreateTableWithStrictMetadata_PreservesPhysicalTableOnRegisterFailure`

## Staging Validation Gates

1. Deploy with `BOOTSTRAP_SCHEMA_MODE=mutate` on a single designated bootstrap writer.
2. Confirm `_System_BootstrapState` updates through phases to `completed`.
3. Force one restart during bootstrap window and verify:
   - no managed-table destructive rollback is executed,
   - failed phase is checkpointed as `failed`,
   - retry resumes from checkpoint phase or later.
4. Deploy follower tasks with `BOOTSTRAP_SCHEMA_MODE=verify` and confirm:
   - readiness verification passes,
   - no broad schema mutation path runs on followers.
5. Validate DDL history for absence of compensation-style managed-table `DROP TABLE` operations during bootstrap retries.

## Production Go/No-Go

Go only if all are true:

- Regression tests pass in CI.
- Staging validation gates pass with evidence.
- Bootstrap writer/follower mode configuration is explicit and reviewed.
- Incident report and rollout evidence are attached to PR.

No-Go if any are true:

- Unexpected managed-table `DROP TABLE` appears in DDL history.
- Bootstrap state cannot be persisted/read reliably.
- Verify-mode startup fails schema readiness checks unexpectedly.

## Backout Criteria and Actions

Trigger backout immediately if destructive DDL reappears or readiness is unstable.

Backout actions:

1. Stop rollout and revert application to last known-safe release.
2. Keep database state intact (no destructive automated rollback SQL).
3. Re-validate staging with corrected patch before re-attempting production rollout.