Release Checklist

Shared Gates

pnpm type-check
pnpm check:error
pnpm lint:ws
pnpm test:unit
pnpm apps:parity
pnpm build

These do not prove external services work. Confirm .source/ is generated by install/dev/build, not hand-edited. Record whether SCENARIOS.md changed or already covers the journey and report unrun checks.

Production Readiness

• Back up production Postgres, run pnpm db:status, then pnpm db:migrate.
• Check S3 credentials, CORS, and the avatar read prefix.
• Configure real Resend or Cloudflare Email Sending; do not use console mail.
• Vercel uses apps/web as its root. Docker builds from the repository root.

Manual and Automated Acceptance

1. Bilingual home/docs/blog/legal, navigation, sitemap/robots; no dangling removed-page links.
2. Actual production origin, OAuth callbacks, trusted origins; login, OTP, logout, expiry, onboarding, 2FA.
3. Unauthenticated denial, user/admin boundaries, session-service errors distinct from login redirects; visible and escapable impersonation.
4. Sandbox checkout, signed webhooks, renewals/cancellation/refunds, access and customer portals; bad gateways/products never falsely succeed.
5. Own avatar/assets upload/download/delete, cross-user denial, missing storage, and empty lists.
6. Contact, newsletter, and signed unsubscribe; no credentials/personal data leaked into clients or logs.

Run pnpm test:api and relevant pnpm test:e2e checks against your configured app; see Testing.

Do not seed development accounts in production, enable Better Auth testUtils, or bypass environment validation to hide missing config. Rehearse existing-database incremental upgrades on clones and keep build rollback/database restore plans.