FOXY-1164 media split decisions and verification
Media split decisions and verification
Section titled “Media split decisions and verification”Law approved the split on 7 October 2026, with mode-aware enrollment. The full source before extraction is commit 366402d49383fdac8442f947383b1c3ba1eacba9. Deferred code and tests remain recoverable from that commit.
| Release | Scope | Deliberate change |
|---|---|---|
| PR1 | Media and unpublished, enrolled Brain Generations | Six media tables. Explicit catalogue enrollment for pilot; NULL auto-enrollment for continuous. No manifest or frozen revision cohort. |
| PR2 | Customer prompt provenance and deletion | Four tables: submissions, parents, owners, character fences. Capture gaps and deletion receipts are omitted. The Clerk deletion RPC must be live on production before merge. |
| PR3 | Paid prompt analysis | Consumer and qualification required before activation. Analysis cleanup and dispatch acknowledgment checks accompany analysis. |
Dropping prompt capture gaps loses durable capture-failure counts. Dropping deletion receipts loses cross-owner event-ID conflict detection. Owner tombstones, character fences, database birth timestamps and replay checks remain PR2 requirements. PR1 does not claim to provide those contracts.
Retained media guarantees
Section titled “Retained media guarantees”- Brain owns enrollment, current source revision and publication authority. Sirloin pulls descriptors and performs tagging.
- Catalogue publication does not wait for tags. Existing explicitness and category relationships remain authoritative.
- Source checks remain fresh before paid dispatch, result acceptance and availability reporting. Cross-service reads and writes cannot be atomic.
- Complete input proof controls shared result reuse. Changed enrolled input may be tagged again within the approved daily cap.
- Budget reservation remains serialized. Unknown older charges retain their ceiling and quarantine. Source deletion retains accounting.
- Accepted evidence and attempt fences are guarded by application transactions; permitted direct SQL no longer has trigger-based immutability protection. Operator reruns create new runs; duplicate wakeups reuse existing work.
- Discovery failures and checkpoints remain durable. Repair, rescue and scratch cleanup do not require paid dispatch.
Verification boundary
Section titled “Verification boundary”The media-only migration regression first failed on tagging.prompt_submissions with the unsplit schema. It now verifies that installation creates no deferred prompt tables or birth columns, while all six media tables exist. The main-chain integration test retains concurrent-prebuild validation, index preservation, idempotent replay and indexed source cascade deletion.
The mode-aware enrollment regression first failed because pilot included a NULL catalogue row. It checks pilot TRUE-only admission, unchanged continuous NULL auto-enrollment and explicit false opt-out. These focused PostgreSQL checks do not establish full-suite, hosted CI, provider quality or deployment readiness.
The previous combined-feature verification receipts refer to earlier source hashes. They do not validate this split. Run the canonical generators and service gates on the final split commit, then record that commit and its results in the PR.
Activation gates
Section titled “Activation gates”Keep paid dispatch disabled until the recipe, sample quality, route, budget and media-transfer approval are current. Historical Wei qualification is limited to its pinned recipe and sample. A local fixture cannot establish production lock duration, provider reliability or population-wide quality.
For PR2, prove the gRPC service trust boundary and durable Clerk deletion acknowledgment. RPC availability on production is a pre-merge gate. This decision does not authorize deployment.
Single media migration and trusted writer boundary
Section titled “Single media migration and trusted writer boundary”PR1 installs only migration 178 after main migration 177. It retains six media tables, foreign keys, supporting indexes and row CHECKs. The three feature functions and triggers are removed. PR2 provenance follows this migration.
Application regression checks must prove idempotent settled costs, accepted-result preservation, provider identity, valid send/retry states and operator-only reruns. Cost above reservation commits a durable cost_breach_at marker alongside settlement and blocks new paid work after restart. Late settlement of older work also halts the current policy. Operator reconfiguration clears the marker and increments epoch; settlement replay must not re-halt an acknowledged attempt.
These checks establish storage API behavior. They do not establish protection from direct writes to allowed mutable columns. Raw SQL is trusted. Existing previews with the old feature ledger require a separately authorized rebuild; this change does not rewrite their migration history or discard spending records.