# ARTH_CODEX operations and final-release checklist

## Current contract

The app has temporary public guest learning, explicitly requested by its owner. Keep Sites access and ARTH_GUEST_ACCESS consistent. Account records always require platform-authenticated identity. Owner instructor configuration is a secret and does not grant administrator rights. Never place it in a report or client bundle. The compiler, review and reward activation switches stay disabled until their documented hosted gates pass. Browser results and local fixtures cannot authorize mastery.

Original lessons and five robots are preserved. Sixteen extension lessons are practice content; capstone briefs require original learner solutions and independent review. Authored hints are not a connected AI tutor. No migration was added for Steps 14–20.

## Reproducible local verification

- `npm run verify:release:local`: schema/content validation, the complete sequential Node suite, native C++17 examples, TypeScript and local handler load.
- `npm run verify:release:local -- --wasm`: additionally runs the original 13 cases, all extension cases and worker resource/error probes through the actual pinned WASM workers under Node.
- `npm run gate:release`: audits persisted release evidence, returns nonzero for unresolved gates, and must not be interpreted as having performed browser tests.
- `npm run build`: production framework build. Publication packaging uses the supported Sites build helper.

Native C++ runs are for authored examples only. Never run learner source on the application server or use the development host as a hosted sandbox. The in-process load test is 500 concept requests with ten concurrent clients; it is not an internet, Worker CPU or D1 capacity test. Local SQLite rollback, concurrent award and restore checks do not establish production D1 behavior.

## Publication and rollback

1. Read current native Sites identity, access, runtime revision and version. Open latest source using the source workflow; reconcile concurrent changes before editing or publishing.
2. Run relevant checks, update evidence honestly, build, and let the source helper commit/push and produce the exact artifact. Never reuse an archive from a different commit.
3. Save and deploy that exact source version with the existing Sites audience. Verify native deployment status; record version/commit outside secrets. Do not replay earlier migrations.
4. If deployment fails or regressions are reported, inspect native deployment status and bounded error logs. Do not log submitted source, exports, tokens or email addresses.
5. Roll back by deploying a previously successful saved version from native Sites version history. Keep runtime/access unchanged unless the incident requires an explicitly authorized change. A source rollback does not undo records or schema migrations.
6. If a database migration is ever necessary, prepare additive compatible schema and a separate rollback/data-retention plan before deployment. Do not infer a database backup exists from a source version.

## Data and recovery

The account export API returns a transactional read of the authenticated user's learning records and authored decisions. It rejects exports beyond 1000 rows per category rather than silently truncating. Exports contain private data. Individual exports are not a full operational database backup.

Deletion requires same-origin JSON plus exact confirmation, removes only the learner's records in dependency order, and rejects active legacy jobs. An atomic guard protects against a job starting between preflight and transaction. Reviews an instructor wrote for other learners remain as attribution on their submissions. The tool does not delete platform sign-in accounts or site sharing. Browser drafts require their separate account-scoped clearing action; reload existing editor tabs afterward.

There is no automatic age-based retention purge. Server records remain until explicit deletion. No new production analytics events, cookies, tracking pixels or external recipients were added. Guest source and tutor notes stay in the page. Anonymous access to export, deletion or instructor analytics is denied even while site login is optional.

The local restore drill copies a closed synthetic SQLite database, reopens it and verifies integrity, foreign keys and expected record counts. A production backup provider, retention period, recovery point objective and recovery time objective are **not yet configured or verified**. Before final release, use an authorized native backup/export mechanism and demonstrate restoration into an isolated authorized environment; never practice destructive restore on live learner records.

## Hosted checks required before final release

- Supported browser skill and authorized browser access; never retry blocked authentication through another tool or proxy.
- C++17 all examples/input cases, multi-file builds, errors, cancel/retry, deadlines, output/memory limits, asset hashes, network/secret isolation, account/tab behavior. Advisory browser quotas are not server security guarantees.
- Entire learning cycle, concept feedback, source drafts/downloads, lesson navigation and stale response handling in actual browsers.
- Distinct authorized learner and instructor: immutable submission, no self-review, required attestations, final decision, reward reconciliation, duplicates, prerequisites, rollback, account isolation and deletion on hosted D1. Do not enable switches merely to collect screenshots.
- Accessibility: keyboard order and visible focus; headings/landmarks/labels; live announcements; screen reader; 200%/400% zoom; narrow mobile viewport; contrast; reduced motion; code/table scrolling. Automated markup/DOM checks alone do not prove accessibility conformance.
- Bounded authorized staging load with measured Worker/D1 errors and latency; set thresholds from agreed workload before testing. Do not flood the production site. Exercise provider failure and recovery.
- Verified backup and isolated restore; deployment rollback; incident ownership and actual alert delivery. No automated monitoring/alert service is claimed as installed.
- Connected AI provider and real hint/prompt-injection/failure checks for Step 13, if keeping the AI requirement.

Only record a hosted pass with date, version/commit, environment, exact test, actual result and evidence. Keep `nextStep` at the earliest unresolved gate. Step 20 is partial until all these required checks pass.