[shiny-code-app]

An empty Odoo production target could not receive its first accepted release: review required a previous version, logical backup required a running stack, and promotion used existing-data mode. The first release now reviews the complete pinned initial version and setup, then delivers runtime inputs and product state through the existing accepted-release worker and executor.

The initial checklist explicitly records absent production. Whole-version test notes are prepared through the existing request route and produce a new exact acceptance digest. Initialization requires that saved acceptance or existing Director-standing acceptance, current empty-target qualification and the original durable operation. Infrastructure capture stays mandatory. Recovery stops only the release's web container and retains data; the first rollback drill then takes a real logical backup and promotes the same accepted candidate using existing data. Unowned state and unknown effects remain held for reconciliation. Private generated-file hash receipts allow safe configuration-only reuse after a conclusive no-stack failure; missing receipts never stand in for proof.

Implements the recorded Q1356 decision under cbusillo/launchplane#6056. No TK operation, exemption, grant or profile change is included. The bounded existing release-request caller companion is cbusillo/codex-skills#4225, owned serially by this native, not a duplicate worker.

Validation: 38 complete release/executor/backup/rollback/authorization/storage safety modules passed 813 tests with eight skips; renderer module passed 131 tests. Receipt corrections reran five affected modules (210 tests), and final native cleanup reran seven affected release/rollback/authority modules (236 tests). Whole Ruff/format/mypy; frontend unit/type/build; desktop/narrow initial review and notes-preparation witnesses passed. Actual producer ASGI/caller transport witness passed Client and Director-standing paths without acceptance/provider calls. Anthropic claude-opus-5-5 independent reviews are weighed in the PR. Latest eleven-file Python native assessment and final WebStorm assessment are GREEN, zero findings. Earlier broader Python coverage remains UNKNOWN native_timeout under Q1333; it is not claimed inspected. Current-head CI is required before Ready.

Removed: separate pre-release baseline requirement, absent-base history traversal, duplicate review preparation/status/digest construction, unrecorded backup-root fallback and redundant production re-read. No backup or first drill is deferred.
Net lines: +3,651 (+3,851/-200); growth covers integrated initial-state/recovery behavior and fictional safety witnesses.

Client test notes

Client change: A first Odoo release shows the complete initial version and its test notes without inventing a previous production version. Preparing notes creates a new checklist for exact acceptance. A request under existing Director-standing acceptance says that it starts the gated release.

Use the fictional first-release review in the browser evidence. Check the version and sources, read the contact/follow-up test notes, and verify the initial request waits for those notes and any other blocker. Acceptance remains a production action on a real product; no real product action belongs to this source PR.

[shiny-code-app]

Review result: weighed
Head: 456e4f3

Independent safety review is weighed for current head 456e4f3526f7e6c08088a33d23192e4ccac95a1f. Author OpenAI; reviewer Anthropic claude-opus-5-5, model confirmed by CLI. The integrated implementation/design reviews and final paired review read the complete release path, custody/inverse boundary and caller; the latest model reviewed producer 8afbb878b and caller bca98ad1. No reviewer identified an unavoidable protection/outcome change. No exemption is adopted.

Acted on every concrete finding. Initial review now uses the complete pinned version/setup/notes; one canonical builder/digest replaces duplicate status construction. Forward fingerprinting stays strict. The inverse uses immutable accepted custody plus fresh physical/ownership/use/data/Live/hold facts, and delivers no edited inputs. It stops only the owned web and retains DB/runner/storage. Genuine infrastructure captures, original-absence evidence, the mandatory first drill and its second real logical backup remain.

Final follow-up A1: a shared bounded receipt helper now preserves a known terminal deployment when private rendered-file readback is unavailable. Exact generated-file receipts still gate config-only empty reuse. The actual executor/drill fixture proves receipt-read ValueError retains the terminal deployment ID and completes the drill; missing receipts never become proof. M2's changed-environment observation is also refused. Real-provider behavior remains untested because this task forbids all TK operations.

A2/R1: removed the redundant production re-read entirely. Every production acceptance/materialization/invitation caller supplies the reviewed checklist; an absent original stamps the required drill from that immutable checklist. The real HTTP witness proves a failing later production read cannot drop the drill. Earlier intermediate fallback wording is superseded by this deletion.

M1: the actual ASGI producer/caller witness passes incomplete private D0 read, exact D1 preparation, lost Client publication/readback/original-D0 replay and standing-policy deduplication; no acceptance or provider calls. The route is internal to release-request in the catalog; no other projection requiring its absent production commit was found. No committed test depends on another checkout. M3: rendered disk hashes qualify config-only reuse; the inverse uses staged API-input hashes and native runtime/storage ownership. These are intentionally different evidence domains.

Optional caller plan-file validation stays: it validates private notes before submission and sends nothing. No new caller policy or endpoint was added. Other preexisting volume-name copies remain outside this bounded first-release change.

Validation: 38 full producer safety modules passed 813 tests (eight declared skips); the renderer module passed 131 tests. Final receipt fixes reran five full affected modules (210 tests), and native cleanup reran seven full affected release/rollback/authority modules (236 tests). Whole Ruff/format/mypy and frontend unit/type/build pass; four desktop/narrow initial review/preparation browser cases pass. Latest native PyCharm assessment of the eleven follow-up Python files is GREEN, zero findings; two advisory terms are legitimate technical names (mountpoints and vzdump). Earlier broader Python coverage remains UNKNOWN native_timeout under Q1333, not represented as inspected. WebStorm coverage is recorded separately. Full current-head CI is required before Ready.

Removed: separate pre-release baseline requirement, absent-base history traversal, duplicate review builder/status/digest work and redundant production re-read. No protection or first drill is deferred.
Net lines: +3,651 (+3,851/-200), including integrated fictional safety witnesses.
Trial LP6056-1112. Native session 01a1d05a-7209-7a03-9096-c60b946b4f0d. No real TK read or operation has run.

[shiny-code-app]

Ready for the merge train

Head: 456e4f3

[shiny-code-app]

Launchplane completed the merge-train step for this pull request.

• Repository: cbusillo/launchplane
• Base branch: main
• Pull request: Deliver the complete initial Odoo version through its accepted release #6066
• Controller action: land_batch
• Controller record: merge-train-batch-landing-plan-20261112T193921Z-5c958e07dbe60db1

Launchplane landed this pull request through protected batch PR #6068.

Launchplane manages this comment and will update it as the train moves.