Write the one decision the window must support. Record when the window opens and closes, the scenarios that fit, and what would make the run no longer useful.
Exercise every cheap path before the scarce one: static checks, unit and contract tests, fixtures, simulators, clocks, credentials, capacity, and recovery drills. A live window should not be the first time ordinary code paths run.
Set side-effect budgets, rate and exposure limits, a kill switch, recovery checkpoints, correlation IDs, and the Abort / Isolate / Degrade / Continue policy. Confirm that an independent operator can stop the system.
Execute the planned scenarios. Record scenario boundaries, inputs, decisions, outputs, external responses, timing, and state changes. The run is an observation, not a pass by default.
Apply only the predeclared response. Isolate a failed unit, enter a declared reduced mode, or continue past an allowed non-critical exception. Stop when an abort invariant fires or state is uncertain.
Close every scenario with an explicit outcome: pass, fail, degraded, skipped, or inconclusive. Preserve the evidence even when the system recovered.
Convert live inputs and events into redacted fixtures, simulators, or record/replay assets. State which environment differences are not reproduced.
Group findings by cause and boundary rather than patching them one at a time in the next live window. Fix the smallest complete set that can be checked offline.
Run offline regression checks, recovery tests, and an independent review. Return to a scarce live window only for evidence that cannot be obtained locally.
A window is complete when its evidence is preserved and every planned scenario has an explicit outcome. Completion does not mean every scenario passed, and it never means a safety stop should have been avoided.
Safety policy · Manifest · 한국어