Deployment

Only pushing a v* tag releases. The job runs on a self-hosted runner on the production machine and never on pull requests.
The deploy script stops the service, backs it up, overwrites it, starts it and smoke-tests it; any failed step rolls back automatically, and the last five backups are kept.
The smoke test fails while a migration is still pending. Otherwise a failed migration would leave the health check returning 200.
"The site loads" doesn't count as a successful release; the workflow run does.

Network

The app listens only on loopback and is reached through a reverse proxy. It trusts only that one proxy on loopback, which is how it keeps the real client IP.

Before cutover, a reconciliation tool diffed every endpoint between the old and new systems. Any mismatch on a high-risk endpoint fails, and those can't be waived.
Tests come in three layers: unit, live integration against the real sources, and reconciliation regression.
A separate set of tests checks that the checks themselves haven't been removed or bypassed. A live test with no credentials reports skipped, never passed.

The ERP sources are read-only, and code review blocks any write to them.
Outbound writes sit behind a dry-run / live switch that flips at runtime; rolling back means switching to dry-run.
Each document is sent once: the ledger is checked before any heavy work.

Risks, open questions and progress each have their own document. Lessons go into a list that only takes mistakes made a second time.