# ADR 0055: Selected-model update inbox

Status: accepted for selected-model tracking; replacement execution remains separate.

The isolated integration introduces schema `20260909_0029` directly after `20260908_0028`.
Watch and notice history are authoritative recovery state. An older backup may gain these tables
only in their exact empty initial state; a current backup must retain their complete semantic
fingerprints. Temporary check tokens and deadlines are excluded and cleared during restore,
with an independent readiness check refusing remaining restored claims.

ModelForge is a central hub for selected models and project capabilities. Upstream monitoring
is opt-in, bounded to 100 explicit model/ref watches. A watch records an existing exact revision
as its comparison baseline. It does not imply that this revision is deployed or that
a subsequently observed commit is newer or better. Alternative repositories require their own
explicit selection; this is not a global model-ranking system.

Manual checks reuse the authenticated Hugging Face metadata and immutable revision boundary.
They create no download plan, worker execution, approval or deployment. Changed commits produce
one durable notice per watch/commit. Dismissal preserves history and repeated checks do not revive
dismissed notices. Lists are bounded and paginated. Provider failure records an error while
preserving the baseline and existing notices.

An atomic database claim bounds concurrent checks. A five-minute lease allows restart recovery;
token fencing prevents expired requests from overwriting a successor's state. The audit chain
serializes creation admission so the 100-watch bound also applies to concurrent creators.
Reads require viewer and mutations require operator. Nested provider audit events use the same
authenticated actor and correlation as the watch operation.

Production processes check enabled watches daily by default, at most one due watch per minute
per API process. Atomic due checks avoid a duplicate scheduled call after another process finishes
the same watch. This is a per-process throughput limit, not a global cross-process scheduler.
Development/test lifespans do not start this monitor. Errors are recorded or logged without
credential content; a monitor configuration flag is not proof of a successful provider check.

Tracking changes use an explicit audited compare-and-swap on the observed version and baseline.
Baseline changes validate the same model and refuse an active check. Pausing fences in-flight
check publication; already-started metadata retrieval may finish, but cannot produce a notice
or overwrite successor state. Historical notice provenance is unchanged. Changing tracking never
changes a deployment. Broad model search, automatic tests, automatic replacement and model-quality
claims are not introduced. Project-bound comparison and evidence-backed replacement
continue through existing capability, evaluation and lifecycle boundaries, including embedding
migration and rollback. This tranche does not complete that replacement workflow.