# PLOCAL Dallas Cutover Checklist

This is a deployment checklist, not an applied production configuration. Confirm the real server type, filesystem paths, PHP-FPM socket/version, document root, TLS host, backups, staging, and rollback authority before use.

## Before deployment

- Verify the deployment artifact excludes `backend/.env`, logs, test output, and local screenshots unless intentionally retained.
- Provision production secrets outside source control.
- Verify PHP 8 compatibility/extensions and MySQL 8/InnoDB/utf8mb4/strict/UTC configuration.
- Verify the production Dallas seed/projection under the approved demo policy.
- Back up configuration and validate restoration.
- Apply only one reviewed server example after replacing every placeholder.
- Confirm all root `.txt`, `.md`, dotfiles, and `/backend/` direct requests are denied.

## Route acceptance

- Confirm only the seven manifest paths reach Laravel.
- Confirm non-slash forms redirect once with 308 and preserve safe query strings.
- Confirm all other PLOCAL pages remain static.
- Confirm `/assets/` is served directly and receives no accidental `X-Robots-Tag`.
- Confirm static fallback files remain in place.

## Browser/SEO/security acceptance

- Repeat desktop and mobile browser screenshots from Phase 2E.
- Re-run canonical, robots, title, description, H1, navigation, asset, console, and overflow checks.
- Verify the seven responses are MySQL-backed and contain no private fields.
- Verify direct requests cannot retrieve backend source, secrets, logs, dependencies, architecture documents, or reports.

## Rollback

1. Remove or disable only the seven allowlist rules.
2. Reload the verified web-server configuration.
3. Confirm the preserved static `index.html` files answer the seven paths.
4. Keep shared `/assets/` active.
5. Do not roll back MySQL or delete Dallas data for a route-layer rollback.