[Brendan-Lim]

Quack's release safeguards were missing from sanitized production, and clean-checkout tests depended on unpublished evaluation output. This integrates the safety changes while preserving six learning paths, Supabase protections, production debug restrictions and PostgreSQL accounting.

Production keeps one transactional PostgreSQL debit for the complete retry allowance; individual retries share that debit. File accounting reserves each attempt separately. Cancelled requests write conservative receipts, and database or receipt failures stop further spending. Real disposable-PostgreSQL regressions cover independent connections, account scope, retries, cancellations and restart behavior.

The remaining changes validate mistake evidence at runtime (including Python -O), preserve corrupt notebooks and cross-tab updates, reject late cancelled replies, add private server-generated request diagnostics, and bundle the original fonts with their existing licenses. Runtime dependency versions are unchanged; a scoped minimatch tooling override resolves the current advisory.

npm run verify:release checks locked inputs, publication history, secrets, Python/web lint and types, offline backend tests, units, the production build, compiled browser tests and all existing journeys. Release verification enables the previously opt-in performance/visual journeys and rejects skipped, failed or flaky browser cases. CI uses one GitHub-hosted job with ephemeral PostgreSQL, complete dependency audits and retained browser failure evidence. Historical prompt regressions use classification-only fixtures verified against the published synthetic dataset; no private student records or raw model output are included.

Validation on the final head: 3,433 backend tests passed (two paid live tests deliberately excluded), 361 frontend unit tests, nine compiled browser checks and 248 browser journeys, with zero skips in required suites. Ruff, mypy, ESLint, TypeScript, production build, dependency consistency, publication guards, Gitleaks and complete Python/npm advisory audits passed. The local command was interrupted after the non-browser checks and resumed at the remaining browser stages on the same final commit. Hosted CI independently runs the complete command without interruption.

Hosted verification: https://github.com/Brendan-Lim/Quack/actions/runs/42457050856

No paid Meta requests, production account writes, destructive database tests, quota increases or unrelated infrastructure changes were performed. Deployment is separately verified after safe merge. Real handwriting accuracy, physical iPad/Apple Pencil behavior and full production Supabase account flows remain outside this synthetic/offline verification.