# Validation status: review branch, not a release

This source change is published for review. Do not deploy it as a verified
security release until the checks below have been completed.

## Completed source checks

- Independent source review of customer/issuer isolation, staff permissions,
  long-lived authorization, channel policy concurrency and session refresh.
- Cross-review of editor draft isolation and customer chat lifecycle boundaries.
- Setup preview/apply permission, transaction and target review.
- Syntax parsing of changed TypeScript/TSX and JavaScript regression sources.
- JSON/YAML parsing, matching new locale keys, and Git whitespace checks.

These checks are not a replacement for compilation or executing the tests.

## Not yet validated

- Go formatting and compilation: the Go toolchain was unavailable during this
  source-review pass. Run gofmt on all changed Go files before merging.
- Automated regression tests: authored but not executed.
- Full frontend typecheck, lint and build with declared dependencies: not run.
  A limited attempt using unrelated available dependencies was incomplete due
  to missing project packages; it is not a successful project typecheck.
- Race detector, actual MySQL CAS/unique-index behavior, and staging additive
  schema upgrade/reconciliation: not run.
- Application/browser acceptance on desktop and narrow screens: not run.
- Production migration, service startup and deployment: not performed.

## Checks required before merge or release

Use the repository's declared Go and frontend package versions, isolated temporary
data, and mocked/loopback external services. Inspect test initialization first;
never point regression tests at a live database or real accounts.

1. Format all changed Go files and compile the relevant packages.
2. Run openidentity and backend security/setup tests, including concurrent identity
   registration, the actual WebSocket pumps, channel CAS and transaction rollback.
   Then run the package suites and race checks where supported.
3. Run the frontend typecheck, lint and build with installed locked dependencies.
4. Run the focused Node tests for customer sessions/store/realtime, message drafts,
   account isolation, setup preview and dismissal navigation.
5. Validate SQLite and MySQL schema upgrades and uniqueness/CAS behavior on backups.
6. Exercise the modified UI in Russian, English and Chinese, including failures,
   account/conversation switches, pending sends and expired sessions.

Do not treat an unexecuted regression test as proof that a defect is fixed.