# Local Bootstrap Validation Report

## Goal

Validate locally that the bootstrap safety changes:

1. prevent destructive rollback behavior (`DROP TABLE` compensation), and
2. keep startup functional in both mutation and verify modes.

## Local Environment

- Local TiDB via `docker-compose.local.yml`
- DB endpoint: `127.0.0.1:4000`
- Database: `nexuscrm`
- Backend run with explicit env vars for local mode switching

## Validation Scenarios Executed

### 1) Mutate mode bootstrap run

Backend started with:

- `BOOTSTRAP_SCHEMA_MODE=mutate`
- `ENVIRONMENT=dev`
- `NEXUS_ENV=dev`

Observed:

- Bootstrap completed successfully.
- `_System_BootstrapState` row persisted with:
  - `StateKey = schema_initialize`
  - `Phase = completed`
  - `Status = completed`

Evidence snapshot:

- `bootstrap_state_rows 1`
- `('schema_initialize', '<run-id>', 'completed', 'completed', ..., <timestamp>)`

### 2) Verify mode startup run (prod-like)

Backend started with:

- `BOOTSTRAP_SCHEMA_MODE=verify`
- `ENVIRONMENT=production`
- `NEXUS_ENV=production`

Observed:

- Log line: `Schema readiness verified (BOOTSTRAP_SCHEMA_MODE=verify)`
- Service started healthy on a separate port.
- In verify mode, mutation-only bootstrap steps are skipped as expected.

Security guard observed:

- Starting in production mode without `JWT_SECRET` fails fast (expected behavior).

### 3) Local restart simulation (mutate mode re-run)

Ran mutate mode again on a clean port after initial run.

Observed:

- `_System_BootstrapState` `RunID` updated to a new run and ended at `completed`.
- No destructive compensation activity observed in DDL history.

## DDL Safety Evidence

Executed local query against `mysql.tidb_ddl_history` for last 30 minutes:

- `DROP TABLE%` count: **0**

This directly supports that runtime compensation no longer performs managed table drops during the tested runs.

## What This Proves

- Mutate mode remains operational locally and records checkpoint completion state.
- Verify mode startup path works and performs readiness verification.
- Local DDL history shows no `DROP TABLE` events during tested bootstrap/restart runs.

## Remaining Risk / Limits

- Local validation cannot fully reproduce orchestrator behavior from ECS (task concurrency, deployment timing, infra networking).
- This report does not replace staging/prod evidence for rollout gates.
- DDL count window is bounded (last 30 minutes) and environment-specific.

## Recommended Next Step

- Keep this local validation as pre-staging evidence.
- Before production, run the staged rollout gates from `docs/bootstrap-rollout-gates.md` to validate behavior under deployment orchestration conditions.