Decision: Approve production cutover scope and operational rollback thresholds

Parent epic: #10

Normative authority

• _docs/specs/open-decisions.md §18: the owner-approved article/non-article cutover-scope boundary;
• _docs/specs/open-decisions.md §15 and closed #26: approved service and recovery targets, but not yet-operational measurement or cutover triggers;
• _docs/specs/07-security-privacy-operations.md: every alert requires a threshold, owner, runbook, and escalation path;
• _docs/specs/09-migration-rollout-roadmap.md: Milestones 7–8, the required cutover signal families, quantitative rollback triggers, and retention window;
• _docs/runbooks/editorial-route-seo-cutover.md and its machine-readable policy: an exact editorial-route threshold packet that is useful input but is neither platform-wide authority nor production authorization; and
• _docs/PROCESS.md.

PM disposition

PARTIALLY RESOLVED / P0 / DECISION / PRODUCTION NO-GO. Do not dispatch an engineering, rehearsal, or production lane under #29.

The product-scope decision is accepted. The separate operational rollback-threshold decision is not. This issue remains open only for that owner decision and its exact handoff; it does not own observability implementation, a rehearsal, or cutover execution.

Accepted product boundary

Strict preservation-first treatment applies only to indexed static articles: /blog/<slug>.html and their canonicals. No article URL redesign or article SEO change is bundled into cutover.

Non-article resources may receive separately approved URL updates or SEO experiments at or around cutover. That allowance is not implicit scope and does not bypass a groomed issue, compatibility classification, route/consumer evidence, independent verification, monitoring, reversibility, or #74’s explicit production authorization.

Unresolved operational decision

An authorized product/operations owner must approve one versioned cutover threshold matrix. Do not infer values, windows, exclusions, owners, or rollback actions from repository code, labels, a development run, or a general SLO.

Closed #26 approves initial service/recovery targets: monthly availability, edge latency, Relay acceptance, content freshness, and environment-specific RPO/RTO. Those targets are inputs, not a complete cutover rollback policy and not operational commitments until #66 supplies accepted queries, measurement windows/exclusions, alarms, named owners, runbooks, escalation, and exercised evidence.

The editorial route policy supplies exact route/canonical/robots/sitemap, editorial 5xx, validated-crawler, organic-landing, indexing, and selected-canonical thresholds for its recorded manifest envelope. It is a bounded input. It does not approve missing thresholds for application, data, email, edge, or operator-security surfaces, authorize production access, or prove that its pinned manifest is the eventual #74 release identity.

The owner-approved matrix must cover every applicable #74 signal family:

• route failures, 404/5xx, redirects, robots, canonicals, sitemap, crawl/Search Console, and organic entrances;
• authentication, registrations, enrollments, representative dynamic writes, score/certificate integrity, and content freshness;
• website intent/job and Relay accepted-versus-delivered state, ambiguity, backlog, duplication, suppression, and one-active-sender safety;
• cache, invalidation, WAF, allowance/cost, readiness, and infrastructure health; and
• security or operator-control failure.

Each row must state the exact signal/query and evidence source; threshold; window/cadence; minimum sample; allowed exclusions; warn, stop/no-go, or rollback action; rollback boundary; accountable owner and escalation; runbook; observation and retention window; reset rule after an incomplete interval or rollback; and redacted evidence destination. Missing, stale, mismatched, unowned, or unavailable required telemetry is a no-go rather than implicit success.

Acceptance criteria

• The owner accepts the narrowed preservation-first boundary for static articles and the separate treatment of non-article resources.
• Article compatibility work, non-article experiments, and unrelated enhancements remain separately classified and reviewable.
• An authorized product/operations owner explicitly accepts one exact versioned cutover threshold matrix covering every applicable signal family and row field above.
• The accepted matrix distinguishes #26 service/recovery targets, the bounded editorial-route policy, and still-missing cutover triggers without promoting any one input to platform-wide production authority.
• The decision record names accountable threshold/escalation owners and records the exact handoff: #66 implements measurement/alarms/runbooks, #73 rehearses the frozen matrix with outbound effects disabled, and #74 consumes that accepted evidence only after separate production authorization.

Validation scenarios for the decision packet

Review every matrix row at healthy, exact-boundary, breached, excluded-window, insufficient-sample, missing-data, stale-query, owner-unavailable, and rollback/recovery states. Verify that each result deterministically yields continue, stop/no-go, or rollback and that no development, synthetic, source-only, or editorial-only evidence is represented as platform-wide production proof.

Dependency and lifecycle boundary

• #26 is a closed approved policy input. #66/#266 own measurement/query/owner/alert/runbook implementation and may prepare evidence for the decision; they do not silently choose the remaining product/operations values.
• #29 is upstream of #73’s final runbook freeze and #74’s exact production authorization. #73 and #74 consume the accepted matrix; they are not prerequisites for choosing it.
• #50, #60, and #71 are independent delivery, migration, and compatibility prerequisites of #73/#74. They are not dependencies of this decision and do not grant threshold or production authority.
• After the authorized owner accepts the complete matrix and the handoff is recorded, #29 may close. #66, #73, and #74 remain open for implementation, rehearsal, live authority, observation, rollback, and retention evidence.

Explicit non-goals

• No repository implementation, test, browser run, deployment, rehearsal, production/protected-data access, provider/credential operation, DNS/edge change, sender activation, Search Console submission, write freeze, rollback, or retirement.
• No reopening the accepted article/non-article scope or the approved #26 target values.
• No inference of production authority, named ownership, thresholds, or successful observation from issue labels, source artifacts, synthetic evidence, or elapsed time.

Read _docs/specs/open-decisions.md §§15 and 18, _docs/specs/09-migration-rollout-roadmap.md, _docs/specs/07-security-privacy-operations.md, _docs/runbooks/editorial-route-seo-cutover.md, and _docs/PROCESS.md. Confirm the authorized owner’s versioned threshold matrix covers every applicable signal family and records the required handoff to #66, #73, and #74. Done means the decision record contains the accepted matrix, owners, escalation paths, and evidence requirements without authorizing implementation or production cutover.