Air-gapped deployment is not a checkbox. It requires offline bundles, mirrored dependencies, update windows, support rules, restore testing, and a clear process for moving evidence and patches across the boundary.