Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/adr/0057-deployed-lineage-convergence.md

@@ -0,0 +1,64 @@
+# ADR 0057: Preserve the deployed migration lineage when integrating the model hub
+
+Status: accepted for implementation; deployment qualification pending.
+
+## Context
+
+The canonical hub and a separately deployed creative branch diverged after schema
+`20260908_0028`. Read-only inspection on 2026-09-09 found image
+`modelforge-api:dfec816` and production schema `20260909_0032`. In that deployed
+lineage, 0029 creates creative allocations, 0030 creates model watches, 0031 adds
+creative governance, and 0032 widens audio workload names. Canonical hub 0029 and
+0030 instead represented newer watches and selected comparisons. The shared
+revision strings do not establish compatible database state.
+
+## Decision
+
+Preserve the deployed 0029–0032 migration artifacts byte-for-byte. Add 0033 after
+0032 to introduce watch `enabled=true` and `version=1`, runtime history protections,
+and selected-comparison storage. Do not stamp, rename applied migrations, or
+downgrade populated production data to resolve the conflict. New installations
+and upgrades from the common 0028-or-earlier lineage follow this same linear graph.
+
+The earlier canonical comparison schema was development qualification, not an
+alternative supported production upgrade source. An isolated database built with
+that conflicting graph must retain its original migration bundle; it cannot be
+upgraded using a revision number alone. Convergence does not authorize discarding
+its data. Any required migration of that separate lineage needs its own explicit,
+verified transfer procedure.
+
+Retain canonical project-first navigation, model-watch pause/CAS and bounded
+comparison execution alongside deployed creative history. ModelForge remains the
+central capability hub. This integration adds no model tournament or external
+creative tool execution.
+
+Native inference and external grants share accelerator admission locks and account
+for all granted or uncertain reservations. Capacity reads inside admission do not
+commit the owning transaction. Unattributed GPU telemetry is not proof that a
+particular external grant materialized; retain its full reservation until explicit
+release. Queued work must revalidate current client, project, priority and approved
+resource before receiving a grant. Expiry cannot be reversed by a heartbeat.
+
+The governance tables belong to the typed persistence model, retaining the exact
+deployed constraints. Downgrading 0033 refuses populated hub or creative history,
+preventing traversal into older destructive downgrade paths.
+
+## Recovery and acceptance
+
+Recovery preserves creative provenance and explicitly marks restored queued/granted
+allocations uncertain. That state does not claim an external process stopped.
+Selected comparisons remain interrupted with their claims cleared. Deterministic
+projections computed from the source rows must prove these exact changes; missing,
+changed or unclassified history blocks readiness.
+
+A deployed watch schema without the new control columns requires a fresh source
+fingerprint with the explicit default-column projection. An old opaque fingerprint
+cannot be rewritten to remove execution-claim fields or invent the new controls.
+Unprojectable archived history remains a recovery blocker requiring its original
+qualified artifact; no hash exception is introduced.
+
+Qualify populated 0032→0033 upgrade and actual dump/restore, audit integrity,
+runtime privileges, competing admission transactions, revoked queued authority,
+expiry and UI stale-response handling. All four immutable images, the actual
+deployment upgrade/rollback plan and the release soak remain separate gates.
+Merging this source does not deploy it or establish RC readiness.