Fence TinyChat meeting publication in native SQL and KV

[rsvistel]

Description

Concurrent syncs could overwrite a meeting's metadata or body, and older clients could rewrite supposedly immutable snapshots. This adds a fixed publication protocol to the existing authenticated SQL service and connectors database, plus a temporary write barrier for converting legacy artifacts safely.

The protocol reserves an operation and generation, verifies original bytes, and publishes the snapshot head and searchable metadata together. It rejects stale workers, supports retries after lost acknowledgements, preserves legacy IDs and aliases, and classifies unverified or ambiguous legacy identities explicitly. Published membership is revoked before delete/purge cleanup; tombstones and cleanup receipts make retries safe. Integral, fractional and null legacy REAL durations are preserved.

Activation rejects generic writes to protected catalog tables. Native KV guards protect immutable snapshots. The legacy migration controls pause only old transcript/meeting/archive artifact paths in the selected space; their graph-database lock is held through KV storage persistence and commit. Generation-checked release rejects stale requests from an earlier cycle. Chat, cursors, credentials, other spaces and native snapshot publication remain available. Control operations remain usable at exhausted quota.

Requests use the existing SQL write authority at the exact application path with unconstrained ancestor authority. Original bodies are limited to 1 MiB and complete UTF-8 command envelopes to 2 MiB. SQLite replay and artifact persistence also share the graph writer gate to avoid competing local transactions.

Validation

• Latest barrier core checks: 10/10, including real SQLite/PostgreSQL independent connections, restart persistence, a paused in-flight KV commit, all mutation entry modes and deprecated delete aliases.
• Latest native controls: 5/5, including actual signed HTTP requests at exhausted quota: status/freeze/release succeed and reserve/stage/publish remain quota rejected.
• Isolated native 1.17.0 acceptance: six real SDK/signed HTTP groups passed, including scoped legacy writes, unaffected chat and neighboring paths, cleanup rejection and generation controls. A separate restart test retained frozen state and original bytes; explicit release restored writes.
• Existing publication and quota regression filters: 26/26; publication route checks: 9/9. The duration correction previously passed the full 303-test core suite.
• A complete private legacy-catalog copy was imported through the real SDK/native protocol, interrupted, resumed and rerun without duplicate operations or snapshots. All original IDs, stored body bytes and SQL cells were retained. Library and companion correctly distinguish nonempty partial evidence from already-empty originals. No provider/model call was used.
• Earlier full core/server and shared real SDK/app/companion gates remain documented in the counterpart execution record. Native tests retain the existing detached SQL-actor teardown panics after successful assertions; the same behavior was reproduced in unchanged tests. This patch does not expand into actor lifecycle changes.

CI follow-up: the corrected migration fixtures passed the full PostgreSQL-backed workspace suite (784 passes and seven ignored), along with workspace/WASM builds, formatting, M1 and capability checks. Current Rust 1.98.1 strict workspace/all-target Clippy and formatting also pass locally after boxing two large unauthorized resource payloads. The two Rust error constructors now take Box<Resource>; their authorization decisions and message strings are unchanged. Core/node library tests on the final fix reported 315 and 361 passes respectively, with five PostgreSQL tests explicitly skipped in that local run. The final Linux CI run passed all six jobs: strict Clippy, formatting, workspace/WASM build, M1, capabilities and the complete PostgreSQL-backed workspace suite (785 passes, zero failures and seven ignored README doctests). All five PostgreSQL integration tests executed successfully.

Rollout and limits

The new central meeting_legacy_write_guard migration creates a table without freezing spaces automatically. Old 1.16.0 binaries do not recognize this applied migration and cannot be used as a direct image rollback. A rollback build must recognize it; activated catalogs additionally require the publication protocol and writer fences. The migration does not silently discard guard generations on downgrade.

The barrier drains protected KV commits; it is not a general distributed migration lease or a claim of atomic cross-instance SQL publication and physical cleanup. Coordinate the current topology and writers, keep private originals/plans, verify imported copies, then release the matching generation. No production activation or live conversion has been performed in these validation claims.

See migration controls and recovery. Dependencies: TinyChat, companion v3 evidence. Draft release preparation #231 selects native 1.17.0 and its deployment artifact.

Type

• Bug fix
• New feature
• Breaking change: activation intentionally rejects old generic meeting writers, and the central migration constrains binary rollback.

System Configuration

Rust/Cargo 1.93.1; Bun 1.4.0 for current SDK/data-copy rehearsals. PostgreSQL guard checks used a fresh local PostgreSQL 12.2 test cluster, now stopped. Production uses the dstack/Postgres/S3 build and still needs its release artifact and convergence checks.

Diligence Checklist

• Documentation updated
• Unit and integration coverage added
• Self-review and independent review completed
• Relevant failed attempts retained
• Dependent releases merged and published
• Production rollout and live migration verified