# ADR 0057: Preserve the deployed migration lineage when integrating the model hub

Status: accepted for implementation; deployment qualification pending.

## Context

The canonical hub and a separately deployed creative branch diverged after schema
`20260908_0028`. Read-only inspection on 2026-09-09 found image
`modelforge-api:dfec816` and production schema `20260909_0032`. In that deployed
lineage, 0029 creates creative allocations, 0030 creates model watches, 0031 adds
creative governance, and 0032 widens audio workload names. Canonical hub 0029 and
0030 instead represented newer watches and selected comparisons. The shared
revision strings do not establish compatible database state.

## Decision

Preserve the deployed 0029–0032 migration artifacts byte-for-byte. Add 0033 after
0032 to introduce watch `enabled=true` and `version=1`, runtime history protections,
and selected-comparison storage. Do not stamp, rename applied migrations, or
downgrade populated production data to resolve the conflict. New installations
and upgrades from the common 0028-or-earlier lineage follow this same linear graph.

The earlier canonical comparison schema was development qualification, not an
alternative supported production upgrade source. An isolated database built with
that conflicting graph must retain its original migration bundle; it cannot be
upgraded using a revision number alone. Convergence does not authorize discarding
its data. Any required migration of that separate lineage needs its own explicit,
verified transfer procedure.

Retain canonical project-first navigation, model-watch pause/CAS and bounded
comparison execution alongside deployed creative history. ModelForge remains the
central capability hub. This integration adds no model tournament or external
creative tool execution.

Native inference and external grants share accelerator admission locks and account
for all granted or uncertain reservations. Capacity reads inside admission do not
commit the owning transaction. Unattributed GPU telemetry is not proof that a
particular external grant materialized; retain its full reservation until explicit
release. Queued work must revalidate current client, project, priority and approved
resource before receiving a grant. Expiry cannot be reversed by a heartbeat.

The governance tables belong to the typed persistence model, retaining the exact
deployed constraints. Downgrading 0033 refuses populated hub or creative history,
preventing traversal into older destructive downgrade paths.

## Recovery and acceptance

Recovery preserves creative provenance and explicitly marks restored queued/granted
allocations uncertain. That state does not claim an external process stopped.
Selected comparisons remain interrupted with their claims cleared. Deterministic
projections computed from the source rows must prove these exact changes; missing,
changed or unclassified history blocks readiness.

A deployed watch schema without the new control columns requires a fresh source
fingerprint with the explicit default-column projection. An old opaque fingerprint
cannot be rewritten to remove execution-claim fields or invent the new controls.
Unprojectable archived history remains a recovery blocker requiring its original
qualified artifact; no hash exception is introduced.

Qualify populated 0032→0033 upgrade and actual dump/restore, audit integrity,
runtime privileges, competing admission transactions, revoked queued authority,
expiry and UI stale-response handling. All four immutable images, the actual
deployment upgrade/rollback plan and the release soak remain separate gates.
Merging this source does not deploy it or establish RC readiness.