# Quote approval action-reference wrapper reconcile

This is a separately reviewed warm-environment migration. It repairs four
`ProcessDefinition` rows whose seven `<actions>` wrappers must become
`<action>` while preserving production approver identities and every unrelated
metadata byte.

It is not Seed, ordinary deployment convergence, or an automatic Prod release
phase. The retired Classic Prod operator no longer invokes it. A future use
must be explicitly approved as migration work, completed before a fresh
successful Staging D3 deployment is tagged for Prod.

## Authority

- Canonical redacted shape:
  `deployments/offline/runtime/reconcile/quote_approval_action_wrapper_reference.json`.
- Exact four-row before/after contract:
  `deployments/offline/runtime/reconcile/quote_approval_action_wrappers.v2.json`.
- Migration implementation:
  `deployments/offline/runtime/reconcile/reconcile_quote_approval_action_wrappers.py`.

The seed fixture is shape authority only. Its `admin@example.invalid`
placeholders are never production payload authority. The reconciler reads live
bytes privately, canonicalizes only reviewed assigned-approver identities for
comparison, accepts only the complete known before or after shape, and derives
the desired live bytes by changing only the seven wrapper tag pairs.

## Execution boundary

A reviewed migration plan must provide:

1. an exact source checkout and manifest hash;
2. a global write fence covering every runtime, adapter, and worker that can
   read or mutate the affected authority;
3. explicit TLS-backed TiDB connection authority supplied at runtime;
4. one dry-run transaction and one apply transaction with independent evidence
   verification;
5. exact post-apply readback before traffic is restored; and
6. rollback or remain-in-maintenance instructions if any mutation has begun.

Both client families run without ambient defaults or reconnect behavior. The
transaction locks the exact four rows, uses binary compare-and-swap guards over
the observed bytes, and aborts before commit if count, identity, or final-byte
assertions disagree. An already-converged rerun updates zero rows and succeeds.

Do not insert this helper into
`.github/workflows/deploy-multi-prod-d3-environment.yml`. If it must accompany a
release, run and close the governed migration first, then deploy Staging D3 and
emit a new D3 Tag from that successful run. If the change can instead be
expressed as an idempotent reviewed SQL Patch Bundle, define and run it as a
separately governed exact-L2 migration rather than routing it through the
application release.

## Evidence

Retain unique dry-run and apply evidence directories. Evidence may contain only
canonical/live before and after hashes, developer names, expected counts,
transaction outcomes, and reviewed source/migration identity. It must not
contain metadata payloads, approver identities, database credentials, host
names, or row IDs.

The deploy Seed Catalog classifies the helper and manifest under
`quote_approval_action_wrapper_reconcile`. That exclusion documents non-Seed
ownership; it does not create an operator entrypoint.

## Retirement gate

Remove this migration only after all supported environments have the canonical
after shape, no retained restore path can reintroduce the before shape, and all
supported runtimes accept the singular wrapper contract.