config: ramp people_scan_dedupe 5->100 (firestore-reads loop WQ25 next-step)

Merged
GI
1d ago
+46-46

Summary

Firestore read config train: disable memory_list_index_window (100→0) and batch_privacy_memoize (100→0), and start people_scan_dedupe at 5% after writer fencing #23733. The prior read loop graded the first two levers flat/WEAK or FALSIFIED; turning them off is not a measured dollar saving. No source query, authority, transcription, speaker, price, Free benefit, or audio-retention behavior is changed here.

Every declaration is a complete 19-key replacement JSON literal. finjob_candidate_queries stays at 5. All four production Cloud Run service overrides now carry the same three changes as listen/pusher; they previously masked them.

Monthly-total enable/epoch split — explicit, no scope expansion

Surfaceusage_month_totalFSR_USAGE_MONTH_TOTAL_EPOCH
Prod backend, backend-sync, backend-sync-backfill, backend-integration100c2fs_20261026_r1
Base, listen/pusher (dev and prod), jobs, desktop backend, all dev services0v1

This preserves the existing qualified Cloud Run reader scope. The inherited PR accidentally copied the Cloud Run 100 literal into previously disabled surfaces while retaining v1. That expansion is removed. Disabled readers cannot initialize/re-stamp ready totals. Epochs are not made globally identical by enabling unqualified readers.

Declarations: backend/deploy/runtime_env/_base.yaml, prod.overlay.yaml, four listen/pusher chart values; generated runtime manifest and registry remain synchronized. The regression test checks complete literals, effective Cloud Run rendering, both chart environments, and the enable/epoch split.

Product invariants affected

  • INV-MEM-4 — keep privacy/deletion authority checks unchanged; people dedupe uses the writer-generation fences in #23733 and has a 0% kill switch.
  • INV-DATA-1 — existing configuration keys and data planes; no routing or ownership change.

Verification

  • Focused suite through backend/test.sh, BACKEND_UNIT_TEST_FILE_LIST naming test_render_backend_runtime_env.py and test_verify_pusher_config_references.py, BACKEND_PYTEST_WORKERS=4, under nice / omi-heavy. 119 passed on the final repair (91 renderer/scope + 28 pusher binding tests).
  • make preflight: 44 passed; normal pre-push gates passed, including both-environment runtime validation and type checking (0 errors). Final pushed head: 52661d092a9c07ff5454f627aa0268037edc6b85; 60 terminal green checks, 0 pending/failed/cancelled, independently checked at 10:50Z on 10-27; all 12 workflow runs completed successfully.
  • Luna's first round found a stale linked monthly-total runbook and a missing-declaration skip in the new test. Both are corrected; same-session delta returned SHIP. Review execs: exec-corn-celery-front-snack-genuine-quiz and exec-cement-normal-thank-shoe-live-magnet.
  • No production reads, writes, applies, merges, or deploys needed for this repair. Config rendering is the measured layer; no live-product acceptance or realized savings claimed.

Lead-owned ship/ramp plan

  1. After the batch entry/soak ends (~11:30Z on 10-27) and lead admission, ship listen → pusher → Cloud Run. Read back actual serving artifacts plus complete per-surface literal/epoch before each next step. All changes remain source-only until the lead ships them.
  2. Keep people at 5. Start its clock only after the last relevant surface serves the config. Hold ≥3 hours and two clean evaluator ticks; require no privacy/deletion violations, speaker/transcript/Free-benefit changes, 5xx or live-p95 regression. Lead expands people to 100 with complete literals on the same surfaces, targeted by 10-28 12:00Z; record a blocker if gates fail. Kill switch: people→0 everywhere applicable, preserving all other keys and the monthly split.
  3. Additional monthly-total scope is a separate qualification. By 10-28 12:00Z, lead attests every actual writer/revision/job/operator path, drains old writers, then aligns new readers to c2fs_20261026_r1 while still at 0 before considering 5. Otherwise record the qualification blocker and leave them off. After two hours with zero synthetic equivalence mismatches and no accounting/Free allowance, contention, 5xx or p95 regression, lead may expand the qualified scope to 100 by 10-29 12:00Z. Never enable a v1 reader against shared production totals. This PR does not enact that expansion.
  4. Monthly-total rollback: readers→0, maintenance stays on. If an old writer runs, keep readers off until all writers qualify and choose a new common epoch before re-enabling. See backend/docs/monthly-usage-totals.md.
  5. Compare absolute caller reads and replacement reads/writes/seed scans against 10-24/25; confirm D+1 billing export before booking net dollars. Realized savings from this repair: $0.

Lead picks up URL, exact head, MERGE READY state and evidence from data/run-2026-10-12-subscription-overhaul/reports/fsown-owner-1027.md; no lead-bus post. Merge/deploy/apply remain with the Infra Rollout Coordinator.