🤖 rbotyee (Claude, operated by @rdhyee) — Raymond's intent: he raised the pipeline↔UI coherence worry on 2026-07-10; a GPT-5.6 audit that morning produced this design; the 7/10 meeting nodded to proceed. What I did: filing the audit's conclusions as the tracking issue.
The failure shape (twice-proven)
#326: the samples table showed place names (from samples_map_lite_v3, which got the #311 fix) that search could never find (from sample_facets_v3, which didn't). Two sibling outputs of the same builder, consumed by the same page, silently diverged in vintage — for weeks, detected only by a user.
The audit found several file-tuples with no runtime vintage guard: facets↔lite↔wide (P0 — the #326 class), facets↔summaries↔cross-filter, vocabulary↔membership↔tree caches, H3 summaries↔lite. Only sample_facet_index↔_meta has a real handshake (the #313 build_id precedent). Since then the surface grew: the search index (#329) added 852 more files whose vintage must track the wide/lite/vocab they were built from.
Related smell (same audit): the deploy smoke's search budget silently encodes artifact sizes — a data-only rebuild can flip CI red with zero code change (happened 2026-07-10).
Proposed mechanism (GPT-5.6's design, sized 3–4 days)
- A release manifest (
release_id, input SHAs, per-artifact {url, sha256}) generated ONLY after the existing offline validator passes over the exact candidate set; uploaded LAST (artifacts first).
- The Explorer pins one manifest URL and derives every parquet URL from it (killing the per-file suffix-bump pinning in explorer.qmd — incl. the hard-coded preload URLs that bypass
R2_BASE).
- Boot validates manifest completeness/version + the existing cheap handshakes (no browser hashing of large files); a failed validation shows an explicit "data release could not be validated" state instead of silently serving a mixed substrate.
- One preview-smoke assertion: known pid/place identical in facets and lite; H3 totals equal the located universe; every configured artifact belongs to the manifest.
Key design note from the audit: the contract is a validated release SET satisfying relational checks, not same-build-process provenance — facets_v4 + lite_v3 are coherent despite separate build invocations.
Sequencing
After the FTS #172 gate resolves (the release manifest then covers the search-index artifacts from birth if FTS goes default). Partial rebuilds must be able to reuse validated unchanged artifacts.
The failure shape (twice-proven)
#326: the samples table showed place names (from
samples_map_lite_v3, which got the #311 fix) that search could never find (fromsample_facets_v3, which didn't). Two sibling outputs of the same builder, consumed by the same page, silently diverged in vintage — for weeks, detected only by a user.The audit found several file-tuples with no runtime vintage guard: facets↔lite↔wide (P0 — the #326 class), facets↔summaries↔cross-filter, vocabulary↔membership↔tree caches, H3 summaries↔lite. Only
sample_facet_index↔_metahas a real handshake (the #313build_idprecedent). Since then the surface grew: the search index (#329) added 852 more files whose vintage must track the wide/lite/vocab they were built from.Related smell (same audit): the deploy smoke's search budget silently encodes artifact sizes — a data-only rebuild can flip CI red with zero code change (happened 2026-07-10).
Proposed mechanism (GPT-5.6's design, sized 3–4 days)
release_id, input SHAs, per-artifact{url, sha256}) generated ONLY after the existing offline validator passes over the exact candidate set; uploaded LAST (artifacts first).R2_BASE).Key design note from the audit: the contract is a validated release SET satisfying relational checks, not same-build-process provenance —
facets_v4+lite_v3are coherent despite separate build invocations.Sequencing
After the FTS #172 gate resolves (the release manifest then covers the search-index artifacts from birth if FTS goes default). Partial rebuilds must be able to reuse validated unchanged artifacts.