PRM21-T02 community-first rollout and recovery

Status: PREPARED / OPERATIONAL_ACCEPTANCE_OWED

Authority: source implementation and GitHub PR only. This document does not authorize a deployment, device installation, provider mutation, public pilot or production certification. Target for a separately authorized rehearsal: https://teste.abastevo.com.br. Source evidence and compatibility policy remain canonical.

Candidate and prerequisite checks

Freeze the merged candidate SHA, migrations 000091/000092, API and worker image digests, Rust preparer revision, APK SHA-256 and configured origin before rehearsal. Schema 000091 adds the receipt policy; 000092 updates rebuildable signal projections and marks existing price keys due for the bounded sweeper. Android Room 12→13 retains address-only catalog rows with address_json. Never infer that the currently running staging revision contains this candidate.

Record current schema, API/worker policies, private storage readiness, retained restore evidence, moderator availability and live intake budget/cleanup health before any change. Missing measured capacity, provider retention or current staging prerequisites keep acceptance OWED. Keep training collection OFF and all existing media/quota/job bounds. Do not seed real contributor GPS/photos or change another workload.

Ordered rehearsal after explicit authorization

1. Back up and rehearse recovery under the existing infrastructure protocol. Apply append-only schema changes before any writer issues v2 receipts. Do not edit an applied migration or remove historical policy/audit facts.
2. Deploy the compatible worker, then API, from the same pinned candidate. Confirm v2 signal derivation and bounded recomputation are functioning before Android consumption. An API that emits v2 with an old geometry-dependent worker is not an accepted candidate.
3. Verify normal signed capture issues photo-capture-community-v2 with no location; a valid previously issued v1/debug receipt retains its original policy/deadline and consumability. Verify unknown policy, revoked key, foreign owner, wrong station, expired receipt and forged optional claim refuse.
4. Install the pinned Android candidate only on an explicitly authorized test device. Deny location, select a manual municipality and search a synthetic nominal station without coordinates. Disambiguate same-name addresses, select a distant station, use the camera, review explicitly and queue/retry without GPS permission. Verify restart, logout/origin switch, camera cancellation, empty/offline catalog and backend-outage states. Do not clear existing device data without authorization.
5. With separate synthetic owned accounts, confirm/dispute and cast/flip/remove helpfulness. Verify exact server tallies, own choice, report reasons, authenticated operator hide/restore and public reference removal/reappearance. Reports/likes do not directly rewrite a price or grant operator authority. A received submission must not be labelled community-validated without the actual independent-evidence result.
6. Observe the existing live media admission, autonomous cleanup/all-copy retention and bounded safety-worker behavior using their own required protocols and elapsed-time evidence. Compilation and disposable MinIO tests cannot substitute for this row.

For every row record UTC time, candidate/configuration, synthetic record identifiers, expected/observed outcome and actual evidence location. No operational row has been executed for this batch.

Rollback and interrupted rollout

Stop new candidate admission through existing operational controls if the worker/API pair is inconsistent; keep private cleanup and safety processing running. Restore a known compatible API/worker pair that can still consume v2 receipts. Never roll back to a binary/schema that rejects outstanding v2 receipts: either retain v2-consumption support or wait for their immutable maximum deadlines and verify the drain. A replay returns the original receipt and never extends its camera/submission expiry.

Keep append-only schema history and authoritative observations/moderation/audit records. Rebuild projections through existing bounded processing; do not enqueue an unbounded bulk backfill or restore deleted evidence. Android rollback retains Room13 readability or requires an explicitly tested compatible build; do not downgrade the database destructively or delete outboxes/drafts. A stored helpfulness OFF preference remains respected. Old or unknown fresh capture policy produces a service recovery message, without requesting GPS or enabling developer preview.

Outstanding acceptance

Actual staging/device execution, provider retention/intake capacity, elapsed cleanup proof and operational moderation availability are OWED. PR integration/remote Quick verification is separate from source acceptance. PRM22 remains DEFERRED until product validation, reproducible strictly >90% independently verified national establishment-point coverage and new explicit policy/implementation authorization. No automatic proximity activation is included.