# Experimental Promotion Checklist

`ExperimentalPromotionGate` evaluates this checklist. Every technical item, then the ADR.

## Technical evidence

- [ ] **Compatibility** — the Stable contract suite passes on the experimental target, twice, on two
      supported patch releases. One passing run is a coincidence.
- [ ] **Security** — for tenancy features, cross-tenant read *and* write are both proven impossible,
      including through native SQL, bulk DML, `getReference`, and the second-level cache. A filter
      that covers only entity queries covers none of those.
- [ ] **Failure** — connection reuse does not leak tenant context; a failover does not silently route
      a read-after-write to a stale replica; the commit-ambiguity scenarios still behave.
- [ ] **Migration** — per-tenant migration is resumable after a partial failure, and rate-limited.
      With one schema per tenant, a run is N independent migrations and "it failed" is not an answer.
- [ ] **Performance** — pool capacity, replica lag under load, and per-tenant memory are measured,
      not estimated. Database-per-tenant fails as a sum, not as an individual pool.

## Decision

- [ ] **Reviewed ADR** — recording what is being promised, the operational burden it carries, and
      what would cause it to be withdrawn.

The ADR is not a formality. The technical suites establish that something works; the ADR records
that the platform should promise it, which is a different question with a different cost.

## What does not count as evidence

- The version being generally available.
- The feature working in one environment.
- A passing suite that skipped because Docker was unavailable.
- A green lane whose assertions were relaxed to make it pass.

## Outcomes

| Decision | Meaning |
|---|---|
| `BLOCKED_TECHNICAL` | at least one suite has not passed |
| `BLOCKED_MISSING_ADR` | evidence is complete; no reviewed decision exists |
| `ELIGIBLE_FOR_STABLE_REVIEW` | both; Stable review may begin |

The two blocked states are distinct because they need different work: one needs evidence, the other
needs a decision.