Validate candidate migration baseline during release

docs/PACKAGE_REGISTRY_RELEASES.md

@@ -59,9 +59,11 @@ Core next, and the meta tag last. This is a dependency guarantee for a
 single-capacity Actions runner: the developer package cannot run before its
 exact Core and module versions have entered the queue.
 
-The same release entry point records the reviewed current Alembic heads under
-the target release version and reruns the strict migration audit before it
-changes package versions, commits, or tags. A failed baseline check therefore
+The same release entry point first validates the migration graph, then records
+the reviewed current Alembic heads under the target release version and reruns
+the strict migration audit before it changes package versions, commits, or
+tags. The default preflight intentionally does not require those heads to exist
+in the previous release baseline. A failed candidate-baseline check therefore
 cannot produce a protected package release.
 
 It builds one wheel and, where applicable, one npm tarball. The workflow records

tests/test_release_entrypoint_gates.py

@@ -51,6 +51,16 @@ class ReleaseEntrypointGateTests(unittest.TestCase):
         self.assertLess(module_push, core_push)
         self.assertLess(core_push, support_push)
 
+    def test_default_migration_preflight_accepts_new_release_heads(self) -> None:
+        script = (META_ROOT / "tools" / "release" / "push-release-tag.sh").read_text()
+        audit_function = script[
+            script.index("run_migration_release_audit()") :
+            script.index("record_migration_release_baseline()")
+        ]
+
+        self.assertNotIn("--strict-if-baseline", audit_function)
+        self.assertIn('command+=("--strict")', audit_function)
+
     def test_source_catalog_generator_enforces_explicit_repo_versions(self) -> None:
         script = (META_ROOT / "tools" / "release" / "generate-release-catalog.py").read_text()
 

tools/release/push-release-tag.sh

@@ -533,7 +533,8 @@ run_migration_release_audit() {
       command+=("--strict")
       ;;
     auto)
-      command+=("--strict-if-baseline")
+      # A coordinated release creates a new baseline after confirmation. The
+      # preflight validates the graph; strictness applies to that new baseline.
       ;;
     warn)
       ;;