# Production Checklist

> A scannable pre-launch checklist for shipping @toolbox-web/grid to production. Each item links to the deep guide.

Use this list **right before you ship**. Each item is one line; click through to the deep guide for the *how* and *why*. If you can tick every box, you're production-ready.

## Security

- [ ] **Sanitize external data** before assigning to `grid.rows` — validate types, ensure unique row IDs, strip unexpected fields.
- [ ] **No `innerHTML` from user input** in custom renderers. Use `textContent`, or sanitize with DOMPurify first. See [Renderer security](/grid/core.md#renderer-security-avoid-innerhtml).
- [ ] **CSP allows `style-src 'self'`** — the grid injects styles via `adoptedStyleSheets`. See [Styles not applying (CSP)](/grid/guides/troubleshooting.md#styles-not-applying-csp).

## Performance

- [ ] **Only the features you use are imported** (or use `/features/*` side-effect imports for tree-shaking). Avoid `@toolbox-web/grid/all` in production.
- [ ] **Fixed `rowHeight`** set for datasets over a few thousand rows. See [Performance guide](/grid/guides/performance.md#scale-tier-reference).
- [ ] **Column virtualization** enabled if you render 50+ columns. See [`ColumnVirtualizationPlugin`](/grid/plugins/column-virtualization.md).
- [ ] **Server-side loading** considered for million-row datasets. See [`ServerSidePlugin`](/grid/plugins/server-side.md).
- [ ] **Bundle size measured** — your final grid bundle is within the [bundle budget](/grid/guides/performance.md#why-its-fast).

## Reliability

- [ ] **Async data fetches handle failure** — `grid.loading` toggled, errors caught, user shown a message.
- [ ] **Grid configuration wrapped in try/catch** as a safety net — [TBW configuration errors](/grid/errors.md) include import hints, but should not crash your app.
- [ ] **Stable `getRowId`** if your rows can be re-fetched / re-sorted — keeps selection, focus, and edit state correct.
- [ ] **Automated tests cover the critical paths** (sort, filter, edit, selection) and use the [stable selector contract](/grid/guides/automated-testing.md) — not visual indices or framework-generated class names.

## Accessibility

- [ ] **Grid has an accessible name** — via `<tbw-grid-header title="…">`, `gridAriaLabel`, `gridAriaLabelledBy`, or `aria-label`.
- [ ] **Tab → arrow keys → Enter → Escape** all work as described in the [Accessibility guide](/grid/guides/accessibility.md).
- [ ] **Tested with at least one screen reader** (NVDA, VoiceOver, or JAWS) — see [Testing with screen readers](/grid/guides/accessibility.md#testing-with-screen-readers).
- [ ] **Forced-colors / Windows High Contrast** verified visually.

## Monitoring (optional but recommended)

- [ ] **Track sort / filter / selection events** (`sort-change`, `filter-change`, `selection-change`) to understand how users use the grid in production.
- [ ] **Sentry / equivalent** captures any uncaught grid errors with the [TBW error code](/grid/errors.md) intact (it's in the message).

## See also

  - [Performance](/grid/guides/performance.md): Profiling, virtualization tuning, and scale-tier reference
  - [Accessibility](/grid/guides/accessibility.md): WCAG 2.1 AA, screen reader testing, focus management
  - [Troubleshooting](/grid/guides/troubleshooting.md): Common deployment issues and fixes
  - [Automated testing](/grid/guides/automated-testing.md): Playwright, Cypress, and WebdriverIO recipes
  - [Error Codes](/grid/errors.md): TBW error code reference