15 — Rehearse and gate the outbox production cutover

## Objective Deliver one controlled, evidence-backed outbox cutover with no mixed direct/consumer ownership, and supply the outbox release gate to existing voting-engine cutover work. ## Coordination and code locations Source acceptance: https://task.matda.me/tasks/tsk_zdaraph9uw. Overall voting-engine cutover/sign-off stays in https://task.matda.me/tasks/tsk_vq9vxh3va7; do not duplicate that entire project. Use config/sidekiq.yml, config/deploy.production.yml, config/deploy.pl.yml, Procfile/Procfile.dev and docs/voting_engine_operations.md / docs/voting_engine_core.md. Respect existing project constraint: no dual writes, legacy runtime fallback, or partial production activation. ## Rollout deliverables - Additive schema and compatible code first with consumer dispatch disabled. Record exact Rails SHA and paired-service versions; recheck command registry against concurrently completed edge-case work. - Rehearse legacy inventory/backfill and require a documented disposition for unresolved effects; do not mass mark pending rows delivered. - Drain old web/workers before enabling consumer-owned effects. Producer ownership, compatible jobs and consumers ship together. Old poll broadcaster jobs must not recreate their self-rescheduling chain; prevent simultaneous direct and consumer effects. - Confirm default/streaming and any required existing queues are consumed, scheduler runs independently, duplicate schedulers are safe and backlog/sweep-health alerts are connected. - Exercise process termination immediately after committed poll start, missed enqueue, Redis outage, worker death, partial delivery and recovery without command resubmission. Verify observed voter UI and durable state transitions. - Exercise provider remote-success/lost-response contracts with authorized staging resources. Measure backlog latency and database/rendering cost under representative voting load; votes may share run sequence. UI must continue during integration outage. - Verify secret redaction, confidential-client refetch, public/secretary/politician audiences and recipient behavior. Capture evidence against each original acceptance criterion. - Rollback runbook pauses dispatch and preserves schema/ledger/remote ownership; it must not restore direct publication while new consumers remain active. Avoid rolling workers back to code that cannot process queued new-format jobs. - Finish operational docs and record outstanding approved exceptions visibly. Do not close the source task or claim strict external guarantees unless all corresponding gates are actually met. ## Validation commands (dedicated test databases only) RAILS_ENV=test bundle exec rails db:migrate RAILS_ENV=test bundle exec rails zeitwerk:check bundle exec rspec spec/services/voting_engine spec/architecture/voting_engine_cutover_spec.rb spec/jobs/voting_engine spec/integration/voting_engine_outbox_delivery_spec.rb bundle exec rspec spec/controllers/secretary spec/controllers/proposals_controller_spec.rb spec/controllers/meetings_controller_spec.rb spec/controllers/api/cloud_router_callbacks_controller_spec.rb spec/controllers/admin/voting_operations_controller_spec.rb spec/services/bias spec/services/kaukus_router spec/services/kaukus_teams spec/services/reporting bundle exec rspec spec/jobs/start_case_job_spec.rb spec/jobs/end_meetings_job_spec.rb spec/jobs/broadcast_vote_job_spec.rb spec/jobs/proposal_notification_job_spec.rb yarn build:js yarn build:css bundle exec rspec spec/system/voting_operations_spec.rb spec/integration/poll_buttons_integration_spec.rb spec/views/secretary/polls spec/views/public_info/polls_view_spec.rb Run the proposed live outbox system spec and bin/translation validate for each added namespace. Run bundle exec rubocop on every changed/new Ruby file. RAILS_ENV=test bundle exec rake parallel:create RAILS_ENV=test bundle exec rake parallel:prepare RAILS_ENV=test bundle exec rake parallel:spec Do not claim validation performed just because commands are listed; attach results/failures and deployed scheduler/provider evidence. ## Depends on All project implementation tasks 01–11 and operational visibility task 13. Release evidence: https://task.matda.me/tasks/tsk_j4u4yd2b25 — recovery/duplicate/rollback regression; https://task.matda.me/tasks/tsk_anwq9m2dfc — legacy reconciliation; https://task.matda.me/tasks/tsk_jjv56ryz3b — visibility and retry runbook. Overall production go/no-go coordinated with tsk_vq9vxh3va7. ## Questions - What maintenance window, operator and paired-service release versions are approved for the single cutover? Do not infer a deadline or activate production from this task alone. - Who owns monitoring/escalation and ambiguous remote-effect reconciliation during rollout? - Are all provider-specific guarantee decisions resolved? Any approved exception must be explicit in go/no-go; local ledger tests cannot waive it.