Release checklist

Clean worktree and reviewed changelog
Locked Composer installation, validation and audit
Deterministic production artifact build, prohibited-path audit, isolated extraction verification, release manifest and SHA-256 validation
Full Pest suite (including MySQL and SQLite integration test legs)
JavaScript syntax and strict repository gate
Static analysis baseline status review (Psalm zero-baseline drive or reviewed residual)
Disposable fresh-install smoke and containerized production boot verification
Foreign key referential integrity status check (schema:foreign-keys:status)
Secret presence, strength, and placeholder validation (APP_KEY, TWO_FACTOR_ENCRYPTION_KEY, RATE_LIMIT_IDENTITY_SALT, and Redis-only CACHE_ENCRYPTION_KEY)
Redis production policy when selected: authenticated staging/production Redis, strong signed-value key, secret-safe diagnostics, and no Redis requirements for the file driver
Content Security Policy (CSP) enforcement verification (report_only => false)
Media derivative queue worker health and pre-decode limit checks
Module asset pipeline adversarial path-normalisation and extension-allow-list tests
Module manifest compilation and freshness (module:manifest:check)
Release checks under production-safe configuration (release:check)
Live frontend, API health and Admin login checks
Authenticated Admin smoke journey
Database and Media rollback points
Globally unique migration basenames and disposable release-upgrade rehearsal
Annotated immutable release tag

Starter experience

Run php8.5 bin/zoosper starter:install twice and verify the second run retains the Site and Pages.
Verify / and /about render through the default starter theme.
Verify the application-owned session path and starter-theme files pass release:check.

RELEASE_TAG=<candidate-tag>
NEXT_VERSION=<next-development-version>

Confirm php8.5 bin/zoosper version reports the release version represented by RELEASE_TAG.
Confirm Admin and API health expose the same authoritative version.
Run the full test suite, quality gate, fresh-install smoke, compile, manifest check, release check, and documentation build.
Record manual browser evidence for login/logout, application-owned sessions, Home/About rendering, Page revision restore, Menu rendering, and Media lifecycle.
Commit and push the release identity, require a clean working tree, then create annotated tag defined by RELEASE_TAG.

Run php8.5 bin/zoosper schema:foreign-keys:status --format=json and require add=0, mismatch=0, and sqlite_rebuild_required=0.
Confirm php8.5 bin/zoosper release:check reports a passing foreign-keys result with the same counts.
Do not retry a failed MySQL apply blindly; inspect status because earlier DDL statements may already have succeeded.
For SQLite, use explicit data-preserving rebuild migrations for existing-table foreign-key changes.
Before release, compile the module manifest so the independent module-manifest readiness check is fresh.