[kitamura-tetsuo]

Issue #50 — provider-bound normal pause verification

The 2026-11-12 staging fixture operation exposed a real failure mode: wrangler rollback selected the old 100%-traffic Worker version, but Cloudflare service settings still retained temporary ALLOW_NEW_TABLES=true. The existing authenticated provider reader correctly rejected that state with provider-version-config-unverified, and the operator restored the canonical paused config with a separately approved full staging redeploy (record).

Changes

• Add a GET-only scripts/release-pause-readback.mjs operator check. It requires reviewed staging/production + peer configs, a separately observed expected active version UUID, manual profile, no restore quarantine, and all five intake/Events/subscription/outbound switches disabled. It verifies actual Cloudflare resource isolation and both settings and 100%-traffic version text bindings using the existing provider reader. Errors are deterministic, fail-closed, and do not print tokens/private state.
• Add six regression tests including both directions of settings/version drift, matching-but-enabled intake, wrong active version, missing approval-state preconditions.
• Update release runbook, operations and preflight docs to separate completed protected staging deployment, same-config rollback and synthetic browser Close/Delete (acceptance) from unapproved production release, different-schema rollback/PITR and unresolved actual account retention/billed usage.

Validation

• node --test scripts/*.test.mjs — 81 passed
• npm test — 301 passed, 42 files
• npm run test:restore-runtime — 2 passed
• npm run typecheck, npx biome check src schema test --diagnostic-level=error, npx biome check scripts/release-pause-readback*.mjs, npm run build — passed.
• Local Playwright E2E could not start: this managed environment returns ERR_SYSTEM_ERROR: uv_interface_addresses even for node:os.networkInterfaces(). Please rely on fresh hosted CI Playwright E2E rather than interpreting this host restriction as app failure.

This PR does not deploy, rotate credentials, change Cloudflare resources, approve production, or close Issue #50. A later protected production deploy requires separately explicit owner and GitHub Environment approval plus current exact-main disclosure/evidence.