config: flag off 9 firestore-read levers on backend-sync 5xx guard breach (URGENT)

Merged
GI
13h ago
+95-98

Summary

Firestore read config train — 5xx-guard flag-off (URGENT). The 2026-10-28T10:02Z evaluator tick failed the backend-sync 5xx guard (rate 0.0035 / 1424 errors vs ref 0.0014, floor 50) and flagged nine levers UNSAFE. This PR sets those nine levers to 0 in every FIRESTORE_READ_LEVERS declaration and keeps the eight SUPPORTED levers at 100. No source query, authority, transcription, speaker, price, Free benefit, or audio-retention behavior is changed here.

Flagged to 0: singleton_loops, usage_month_cache, backfill_task_reads, historical_scan_memo, ledger_purge_coalesce, people_scan_dedupe, queue_age_sample_budget, finjob_candidate_queries (was 5), usage_month_total (was 100 on Cloud Run only).

Kept at 100: deletion_marker_cache, subscription_cache, request_read_dedupe, serving_config_cache, candidates_page, action_items_page, mcp_conversation_cards_cache, canonical_statuses_dedupe. memory_list_index_window and batch_privacy_memoize stay 0.

Monthly-total split — dissolved by this flag-off

usage_month_total goes to 0 on every surface, including the four prod Cloud Run services. The previously qualified c2fs_20261026_r1 epoch declarations are left untouched: every reader is off, so no reader seeds or overwrites ready totals, and Cloud Run's qualified epoch stays recorded for a deliberate re-enable. Re-enable path per the loop guard: if the 5xx rate persists with these levers at 0, each lever is exonerated and may come back at 5% individually with complete-literal changes, restoring the monthly-total split at that point.

Declarations: backend/deploy/runtime_env/_base.yaml, prod.overlay.yaml (all four Cloud Run service overrides), four listen/pusher chart values; generated runtime manifest, flag registry, and both contract tests updated (test_verify_pusher_config_references.py pin; test_firestore_train_preserves_monthly_reader_scope_and_cloud_run_overrides now asserts readers-off on every surface with epochs unchanged).

Product invariants affected

  • INV-MEM-4 — keep privacy/deletion authority checks unchanged; this is a read-cache/scan-dedupe flag-off with 0% kill switch semantics in the direction of safety.
  • INV-DATA-1 — existing configuration keys and data planes; no routing or ownership change.

Verification

  • Focused suite: test_render_backend_runtime_env.py + test_verify_pusher_config_references.py — 119 passed on this head.
  • Complete-literal check: all 42 literal sites (11 base + 4 prod overlay + 22 rendered manifest + 4 chart + 2 test pins) grep-verified: every flagged lever is 0, every kept lever is 100/0 as intended, no other key moved.
  • Diff is literal-only outside README + one test expectation block; runtime_env.yaml changes are exclusively FIRESTORE_READ_LEVERS value lines.

Lead-owned ship plan (URGENT flag-off train)

Ship listen → pusher → Cloud Run as soon as the train allows (FIRESTORE_READ_LEVERS order listen → pusher → Cloud Run); desktop-backend and jobs follow the standing train. This is a guard-response rollback: reads give back until attribution lands. If the breach is attributed to a non-lever cause (sync-path code PRs #23849/#23857 merged 08:33–09:01Z inside the breach window are candidates), restore the prior literal (#23837 state) in every applicable full literal, retaining the monthly-total split.