Go, conditional go, no go

Written before the decision has to be made, so that the answer is read rather than argued.

Go

All of these are true. If they are, open the window. They are not weighted and they do not trade against each other, so a gap in any one of them stops the launch unless that exact gap is named in the conditional go table below.

1. Golden vectors pass on the exact build that will run.
2. Two independent implementations produce identical state roots across the full rehearsal range.
3. Both indexers are synced to the mainnet tip and readiness behaves correctly.
4. The mainnet deployment record exists, names two approvers, and both have approved.
5. spec_sha256 published, and matching what status reports on both indexers.
6. A full mint has been completed on signet by someone who did not build the tooling, following only the published walkthrough.
7. Every deliberate failure rehearsal produced the correct reason code and a clear explanation in the product.
8. A restore drill has been completed, with the measured recovery time written down.
9. Every statistic in the product comes from a live call and has an honest empty state.
10. The three limits appear in the product itself.
11. Alerts route to a named on call person for the whole window.
12. Documentation is published, links resolve, and the byte examples have been recomputed.

Conditional go

Open the window, with a specific mitigation named, owned, and published.

A conditional go is only conditional if the mitigation has an owner and a deadline. Without both, it is a no go wearing optimism.

No go

Any one of these stops the launch. Not a discussion, not a vote.

1. Golden vectors fail, on any case.
2. Two implementations disagree on any state root, anywhere, unresolved.
3. The deployment record is missing, unapproved, or has fewer than two approvers.
4. Window heights have not been checked arithmetically against 4032 and 4032.
5. The indexer serves data while unsynced, or readiness reports ready when it is not.
6. Reorg rollback and replay do not reproduce the same state root in testing.
7. Any surface shows a number that did not come from a live call.
8. Any surface simulates a successful mint, or shows a countdown that is not a real block count.
9. The mint flow can produce a transaction that loses a user's coins, in any tested path.
10. A rehearsal mint failed for a reason nobody can explain.
11. No restore drill has been completed.
12. Nobody is on call.
13. The honest limits are not in the product.

Who decides

• Go requires two approvers, the same two named on the deployment record.
• Any single person on the team can call a no go, and it stands until the condition is resolved.
• A conditional go requires the mitigation owner to accept it in writing.
• The decision, the date, the block height, and the names are recorded.

Delaying is cheap

Nothing is lost by opening the window later. There is no competitor race, no expiring opportunity, and no promised date to break, because the announcement publishes heights and those heights can be republished. The public Firstlight Seals page declines to name an opening height for the same reason. The only irreversible mistake available is opening a window that should not have opened.