From 8e890b37ed89c8c41442f8f21d918f9423820ee8 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Tue, 4 Aug 2026 15:01:50 +0200
Subject: [PATCH] Validate candidate migration baseline during release

---
 docs/PACKAGE_REGISTRY_RELEASES.md      |  8 +++++---
 tests/test_release_entrypoint_gates.py | 10 ++++++++++
 tools/release/push-release-tag.sh      |  3 ++-
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/docs/PACKAGE_REGISTRY_RELEASES.md b/docs/PACKAGE_REGISTRY_RELEASES.md
index 3e2f069..aa875ec 100644
--- a/docs/PACKAGE_REGISTRY_RELEASES.md
+++ b/docs/PACKAGE_REGISTRY_RELEASES.md
@@ -59,9 +59,11 @@ Core next, and the meta tag last. This is a dependency guarantee for a
 single-capacity Actions runner: the developer package cannot run before its
 exact Core and module versions have entered the queue.
 
-The same release entry point records the reviewed current Alembic heads under
-the target release version and reruns the strict migration audit before it
-changes package versions, commits, or tags. A failed baseline check therefore
+The same release entry point first validates the migration graph, then records
+the reviewed current Alembic heads under the target release version and reruns
+the strict migration audit before it changes package versions, commits, or
+tags. The default preflight intentionally does not require those heads to exist
+in the previous release baseline. A failed candidate-baseline check therefore
 cannot produce a protected package release.
 
 It builds one wheel and, where applicable, one npm tarball. The workflow records
diff --git a/tests/test_release_entrypoint_gates.py b/tests/test_release_entrypoint_gates.py
index 0448f53..a40a29e 100644
--- a/tests/test_release_entrypoint_gates.py
+++ b/tests/test_release_entrypoint_gates.py
@@ -51,6 +51,16 @@ class ReleaseEntrypointGateTests(unittest.TestCase):
         self.assertLess(module_push, core_push)
         self.assertLess(core_push, support_push)
 
+    def test_default_migration_preflight_accepts_new_release_heads(self) -> None:
+        script = (META_ROOT / "tools" / "release" / "push-release-tag.sh").read_text()
+        audit_function = script[
+            script.index("run_migration_release_audit()") :
+            script.index("record_migration_release_baseline()")
+        ]
+
+        self.assertNotIn("--strict-if-baseline", audit_function)
+        self.assertIn('command+=("--strict")', audit_function)
+
     def test_source_catalog_generator_enforces_explicit_repo_versions(self) -> None:
         script = (META_ROOT / "tools" / "release" / "generate-release-catalog.py").read_text()
 
diff --git a/tools/release/push-release-tag.sh b/tools/release/push-release-tag.sh
index df911f2..71e2069 100644
--- a/tools/release/push-release-tag.sh
+++ b/tools/release/push-release-tag.sh
@@ -533,7 +533,8 @@ run_migration_release_audit() {
       command+=("--strict")
       ;;
     auto)
-      command+=("--strict-if-baseline")
+      # A coordinated release creates a new baseline after confirmation. The
+      # preflight validates the graph; strictness applies to that new baseline.
       ;;
     warn)
       ;;