[shiny-code-app]

The accepted coherent-release plan replaces the separate first-release, testing-rebuild and promotion paths with one controller, so the artifact that passed preview and testing is checked for production before the Client is asked to accept it.

Refs #6072. This is the single PR for that Launchplane change. Draft: the controller replacement is incomplete. Do not Ready, merge or deploy this partial head.

The initial commits fix a decision-binding gap in the existing paths: a queued operation for one accepted release could execute another release's settings on the same artifact after settings or the production base reverted. Odoo forward promotion and queued-run admission now reject a different recorded decision. Generic-web Client releases carry their original decision through the durable adapter into that same check. The Client worker and workflows share the decision ID/digest predicate; existing persisted-cutover recovery keeps its original authority.

The remaining work is the accepted plan's common whole-release preflight/controller, driver recovery and inert recovery plan, truthful observations, historical adapters, complete entry-point migration, independent Client/use/copy/sharing facts, staff-migration capability and deletion of superseded first-empty, rebuild, recipient and signup orchestration. The deployed controller must start with Client delivery held, including queued accepted releases. The final negative net-line gate and deployed throwaway proof are not earned by these initial commits.

Measured intermediate diff against the starting main commit:

• Removed: 17 lines, including duplicate decision checks and the supplied-decision override.
• Net lines: +181 (198 added / 17 removed). This does not satisfy the final smaller-repository requirement; no deletion credit is claimed for machinery that remains.

Validation of the preparatory commits: 285 tests across ten touched release, promotion, backup, cutover and generic-web safety modules; 167 follow-up tests after final predicate/test changes; repository Ruff checks/format and mypy pass. The two new regression scenarios use valid persisted decisions. Mutation probes reproduce logical-backup admission and generic-web deployment when the respective decision binding is removed. Final outside-review and native-inspection evidence is recorded in PR comments. Current-head CI is separate evidence and does not make the unfinished controller ready.

Proof prerequisites were reported on the issue. The coherent-pass lead assigned proof-product and synthetic-identity setup to a separate worker. No product, resource, grant or live runtime operation is performed by this source task.

Client test notes

Nothing for the Client to test: this toolkit change is qualified on the Director's throwaway products before Client work resumes. The partial draft is held for continued engineering.

[shiny-code-app]

Review result: weighed
Head: 4538734

Outside review weighed for final head 4538734. The reviewed behavioral head was 58b3120; the only later change makes one test-store cast explicit for PyCharm. The focused regression and static check passed again. That test-only type correction did not require another model inference.

Two primary Anthropic reviews reported claude-opus-5-5; effort was not reported. Both distinguished these preparatory commits from the unfinished controller and found no blocking defect in this scope.

Acted on five first-round findings: shared the existing decision ID/digest predicate with the Client worker; passed the generic-web operation's original decision through its durable adapter and workflow; replaced invalid mutated-record tests with valid persisted acceptances; exercised queued Odoo logical-backup admission and the real generic-web settings-revert race; shortened the docs. Mutation probes show the two forwarding omissions cause actual behavior assertions to fail. The follow-up review confirmed those corrections and preserved original-operation recovery.

Unresolved within #6072, for the same-PR controller continuation: effect-time authority still uses the newest-overall decision rule separately from checklist approval; generic-web performs duplicate checklist reads before effects; a persisted pre-effect Odoo cutover can remain held after its decision is superseded and needs the planned original-operation reconciliation/continuation; first-empty, recipient, HTTP and Mediaforce adapters remain to migrate. These are not marked fixed or refuted. The successor must consolidate them through the existing authority/controller path rather than add another wrapper. The regression's in-place Odoo fixture is narrower than the final CM two-slot proof; that complete driver coverage remains required.

The full controller, production preflight, deletion/negative-size gate, route enumeration proof, CI/train landing, deployment and throwaway proof remain incomplete. This draft is not Ready and must not deploy. No DIRECTION protection or agreed outcome was removed.