Unify admin CMS and harden Gemini OCR and storyboard execution

.gitattributes

@@ -22,3 +22,20 @@ apps/web/performance/tzuyang-review-census-20261009/checkpoint-v1/census_admissi
 # Preserve original bytes of sealed production build logs bound to detached maps.
 apps/web/performance/readiness-develop-integration-20261010/production-build-v7.log -text
 apps/web/performance/readiness-followthrough-20261010/production-build-final-v10.log -text
+
+# The hash-bound audit bundle contains literal unified-diff blank context lines.
+# Preserve those space markers; other whitespace checks still apply.
+apps/web/performance/cross-audit-20261018/source_bundle.txt whitespace=-blank-at-eol
+# Forward readiness SQL is sealed by the retained PG17 replay and audit bundle.
+backend/supabase/migrations/20261016090000_review_verification_delete_guard_readiness.sql whitespace=-blank-at-eof
+
+# Preserve literal bytes of the final-source package and its failed build receipt.
+apps/web/performance/cross-audit-20261018/final-source-antithesis-post-cms/final-source-antithesis-source_bundle.txt whitespace=-blank-at-eof
+apps/web/performance/cross-audit-20261018/followup-verification/web-build.txt whitespace=-blank-at-eol
+
+# Preserve hash-bound original audit Markdown hard breaks and the raw test receipt.
+# These exact evidence paths retain their bytes; source whitespace checks stay enabled.
+apps/web/performance/cross-audit-20261019/ocr-indeterminate-recovery-independent-audit/audit.md whitespace=-blank-at-eol
+apps/web/performance/cross-audit-20261019/ocr-indeterminate-recovery-independent-audit/final-candidate-audit-20261018T195954Z.md whitespace=-blank-at-eol
+apps/web/performance/cross-audit-20261019/ocr-indeterminate-recovery-independent-audit/syntax-delta-followup-20261018T201149Z.md whitespace=-blank-at-eol
+apps/web/performance/cross-audit-20261019/ocr-admission-recovery-app-integrated-verification/recovery108-source-ready-scoped-20261019.txt whitespace=-blank-at-eof

.github/receipt-ocr-post105-sql-successor.v1.json

@@ -0,0 +1,67 @@
+{
+  "schemaVersion": 1,
+  "id": "receipt_ocr_post105_sql_successor_v1",
+  "purpose": "receipt-ocr-definitive-credential-release-post105",
+  "projectRef": "aqlcofblfxdrjhhdmarw",
+  "serverMajor": 17,
+  "databaseName": "postgres",
+  "executorRole": "postgres",
+  "advisoryLockKey": 7311754282260313,
+  "launchPolicy": {
+    "state": "held",
+    "code": "RECEIPT_OCR_POST105_LAUNCH_HELD",
+    "reason": "source-only-contract-pending-exact-pg17-constituent-and-aggregate-evidence"
+  },
+  "protectedSource": {
+    "remote": "origin",
+    "ref": "refs/heads/main",
+    "repositoryUrl": "https://github.com/twoimo/tzudong.git"
+  },
+  "stateRootAlgorithm": "review-media-ledger-identity/v1",
+  "operatingTransition": {
+    "before": 105,
+    "after": 106
+  },
+  "predecessor": {
+    "manifestPath": ".github/review-media-evidence-prefixed-feature-successor.v1.json",
+    "manifestSha256": "45b7f146f31bca9afb863152fd616529e90562fb1b3ecbaa409c218439d41867",
+    "ledgerCount": 105,
+    "terminalIdentityRoot": "3ef9d904fd9545027d39041483e5375e6d9c861f5f1a64a61c23b94df1146e4c"
+  },
+  "rehearsalFixture": {
+    "path": "apps/web/performance/feature-sql-integration-20261013/pg17-evidence-prefixed-aggregate-compiled-20261018.json",
+    "receiptSha256": "0efdf7f1c9c60feda3d14d9473c464fa8ce91a23d5f12d9427bfbac2d4ccc0c6",
+    "ledgerCount": 105,
+    "terminalIdentityRoot": "2a1548759fa029261eebd8d121777e3ca7d51520722c750c4a1b0794040a0ab0",
+    "targetIdentityRoot": "b6184e8b14977dcba0d66959d1ef266b29268f5420b86451a7d213b81d5c6e24"
+  },
+  "migration": {
+    "id": "receipt_ocr_definitive_credential_rejection_release",
+    "version": "20261018152032",
+    "name": "receipt_ocr_definitive_credential_rejection_release",
+    "path": "backend/supabase/migrations/20261018152032_receipt_ocr_definitive_credential_rejection_release.sql",
+    "sha256": "9dc92d7b42f8329d16b61ac51bf0b05a8533a1655a94faa8cd74e3d9a92fe74c",
+    "statementCount": 44,
+    "statementVectorSha256": "54df90f1f3e6b23eb11b949d4c0d57856e02dcfb66fc998b5065cc424a34d14e"
+  },
+  "operatingIdentity": {
+    "migrationIdentityRoot": "17dc235a7c78f273a2e4c1d9030995f712da1a2e42e8cca28c8c7b732b37e65a",
+    "suffixRoot": "a1d19693f49105141cb75c37645824a41637e5a8047aaca837fd853d4fbe4b07",
+    "targetIdentityRoot": "83a1b91fa12541581e53dca933a12ca6c5aa4470dd70f912444d38dcd19522c1"
+  },
+  "requiredWriterFences": {
+    "adminRecordMutationsHold": "active",
+    "g037WriteFreeze": "active",
+    "automaticReviewer": "stopped",
+    "browserRpc": "stopped",
+    "directSql": "stopped",
+    "dashboard": "stopped",
+    "providerIngress": "stopped"
+  },
+  "toolchain": [
+    {
+      "path": "apps/web/scripts/receipt-ocr-post105-sql-successor.mjs",
+      "sha256": "4ba7e8b5c12e212809acf6d3c5fdaed4cf58ac70a1c663c25fb7db0bc979ebda"
+    }
+  ]
+}

.github/receipt-ocr-post106-acl-admission-sql-successor.v1.json

@@ -0,0 +1,79 @@
+{
+  "schemaVersion": 1,
+  "id": "receipt_ocr_post106_acl_admission_sql_successor_v1",
+  "purpose": "receipt-ocr-credential-release-acl-admission-post106",
+  "projectRef": "aqlcofblfxdrjhhdmarw",
+  "serverMajor": 17,
+  "databaseName": "postgres",
+  "executorRole": "postgres",
+  "advisoryLockKey": 7311754282260314,
+  "launchPolicy": {
+    "state": "held",
+    "code": "RECEIPT_OCR_POST106_ACL_LAUNCH_HELD",
+    "reason": "source-only-contract-pending-exact-pg17-default-acl-negative-and-aggregate-evidence"
+  },
+  "protectedSource": {
+    "remote": "origin",
+    "ref": "refs/heads/main",
+    "repositoryUrl": "https://github.com/twoimo/tzudong.git"
+  },
+  "stateRootAlgorithm": "review-media-ledger-identity/v1",
+  "operatingTransition": {
+    "before": 105,
+    "intermediate": 106,
+    "after": 107
+  },
+  "predecessor": {
+    "manifestPath": ".github/review-media-evidence-prefixed-feature-successor.v1.json",
+    "manifestSha256": "45b7f146f31bca9afb863152fd616529e90562fb1b3ecbaa409c218439d41867",
+    "ledgerCount": 105,
+    "terminalIdentityRoot": "3ef9d904fd9545027d39041483e5375e6d9c861f5f1a64a61c23b94df1146e4c"
+  },
+  "baseSuccessor": {
+    "state": "held_unapplied",
+    "manifestPath": ".github/receipt-ocr-post105-sql-successor.v1.json",
+    "manifestSha256": "ecc1d0678210f4ac06fe47fc4b62cfdd0694511aacc18ab20978d3e83d82af81",
+    "compilerPath": "apps/web/scripts/receipt-ocr-post105-sql-successor.mjs",
+    "compilerSha256": "4ba7e8b5c12e212809acf6d3c5fdaed4cf58ac70a1c663c25fb7db0bc979ebda",
+    "operatingTargetIdentityRoot": "83a1b91fa12541581e53dca933a12ca6c5aa4470dd70f912444d38dcd19522c1",
+    "rehearsalTargetIdentityRoot": "b6184e8b14977dcba0d66959d1ef266b29268f5420b86451a7d213b81d5c6e24"
+  },
+  "rehearsalFixture": {
+    "path": "apps/web/performance/feature-sql-integration-20261013/pg17-evidence-prefixed-aggregate-compiled-20261018.json",
+    "receiptSha256": "0efdf7f1c9c60feda3d14d9473c464fa8ce91a23d5f12d9427bfbac2d4ccc0c6",
+    "ledgerCount": 105,
+    "terminalIdentityRoot": "2a1548759fa029261eebd8d121777e3ca7d51520722c750c4a1b0794040a0ab0",
+    "stage106IdentityRoot": "b6184e8b14977dcba0d66959d1ef266b29268f5420b86451a7d213b81d5c6e24",
+    "targetIdentityRoot": "1b869222e1efc419e744eeabda52fd1d1900a6a71308a7227a583859136706f7"
+  },
+  "migration": {
+    "id": "receipt_ocr_credential_release_acl_admission_v2",
+    "version": "20261019120000",
+    "name": "receipt_ocr_credential_release_acl_admission_v2",
+    "path": "backend/supabase/migrations/20261019120000_receipt_ocr_credential_release_acl_admission_v2.sql",
+    "sha256": "512f778b71a196e28f092266782fe5938b7d15ec72b61bf05978f3b1696faec9",
+    "statementCount": 27,
+    "statementVectorSha256": "37decc48cfcd3cbb9e40afd6511929262da2400264aa1f18e51317a01d92e9bf"
+  },
+  "operatingIdentity": {
+    "stage106IdentityRoot": "83a1b91fa12541581e53dca933a12ca6c5aa4470dd70f912444d38dcd19522c1",
+    "migrationIdentityRoot": "54d0570e259be8f6435da9ab655424d98a0566e36809ce37d52c631ebad2f696",
+    "suffixRoot": "d473f460ed45863ce606769339c7929e7735675159c3da1a11653bcbca16a664",
+    "targetIdentityRoot": "cd04aebfc1efcc5588486adf3b7ba47fc5b5b76e39a9c23e316768f2919d9d9e"
+  },
+  "requiredWriterFences": {
+    "adminRecordMutationsHold": "active",
+    "g037WriteFreeze": "active",
+    "automaticReviewer": "stopped",
+    "browserRpc": "stopped",
+    "directSql": "stopped",
+    "dashboard": "stopped",
+    "providerIngress": "stopped"
+  },
+  "toolchain": [
+    {
+      "path": "apps/web/scripts/receipt-ocr-post106-acl-admission-sql-successor.mjs",
+      "sha256": "5dd0c66725e14ee9584dd162dccda4419c304ddbda6f3f28b1e645b7aa686b21"
+    }
+  ]
+}

.github/receipt-ocr-recovery108-sql-successor.v1.json

@@ -0,0 +1,73 @@
+{
+  "schemaVersion": 1,
+  "id": "receipt_ocr_recovery108_sql_successor_v1",
+  "purpose": "receipt-ocr-provider-indeterminate-recovery",
+  "projectRef": "aqlcofblfxdrjhhdmarw",
+  "serverMajor": 17,
+  "databaseName": "postgres",
+  "executorRole": "postgres",
+  "advisoryLockKey": 7311754282260318,
+  "launchPolicy": {
+    "state": "held",
+    "code": "RECEIPT_OCR_RECOVERY108_LAUNCH_HELD",
+    "reason": "source-ready-held-no-operating-executor-or-hosted-authorization"
+  },
+  "protectedSource": {
+    "remote": "origin",
+    "ref": "refs/heads/main",
+    "repositoryUrl": "https://github.com/twoimo/tzudong.git"
+  },
+  "stateRootAlgorithm": "review-media-ledger-identity/v1",
+  "operatingTransition": {
+    "before": 107,
+    "after": 108
+  },
+  "predecessor": {
+    "state": "source_ready",
+    "manifestPath": ".github/receipt-ocr-post106-acl-admission-sql-successor.v1.json",
+    "manifestSha256": "58adb514cbdf4221952b9bddfc75dead6a91f74d6fedc0d39445983c542e9b5a",
+    "ledgerCount": 107,
+    "terminalIdentityRoot": "cd04aebfc1efcc5588486adf3b7ba47fc5b5b76e39a9c23e316768f2919d9d9e"
+  },
+  "migration": {
+    "id": "receipt_ocr_indeterminate_recovery",
+    "version": "20261019130000",
+    "name": "receipt_ocr_indeterminate_recovery",
+    "path": "backend/supabase/migrations/20261019130000_receipt_ocr_indeterminate_recovery.sql",
+    "sha256": "d3258b679cbf42ecd97edeab941a5bbaf30fa7b15d968081b60b8b600a3ecd1a",
+    "statementCount": 83,
+    "statementVectorSha256": "3d0bfeb1229b194f818b95a1b4b1ba50609770a93afd8e3c67daabd513c0bd56"
+  },
+  "operatingIdentity": {
+    "migrationIdentityRoot": "0f6f764cb097b9ae1e5387a395411ea6fcd98cd5286bace4542901a1c08f3f6e",
+    "predecessorIdentityRoot": "cd04aebfc1efcc5588486adf3b7ba47fc5b5b76e39a9c23e316768f2919d9d9e",
+    "targetIdentityRoot": "2c7b7fff113a68ad4b73a8ebb005296ddd1344de5fa09fcf828b905e4517bb1d"
+  },
+  "fixture": {
+    "path": "backend/supabase/tests/receipt_ocr_indeterminate_recovery.sql",
+    "sha256": "01766da42c73195925c4fdcf3dbbdcf1efb651b947e3087481306f86179e76c2"
+  },
+  "aclInitialDefaultFixture": {
+    "path": "backend/supabase/tests/receipt_ocr_indeterminate_recovery_acl_initial_default.sql",
+    "sha256": "01a712df0fa0de40c3b0760f52d51c8238bc0f4ecb5ebb8f53160eb1fa5a9e20"
+  },
+  "aclAdmissionFixture": {
+    "path": "backend/supabase/tests/receipt_ocr_indeterminate_recovery_acl_admission.sql",
+    "sha256": "76317420f3be8199fccfbf716ad024573dad324d6f906c3a811c70e4e28df66e"
+  },
+  "toolchain": [
+    {
+      "path": "apps/web/scripts/receipt-ocr-recovery108-sql-successor.mjs",
+      "sha256": "5a9154f51cfe19f25007ce1737eee969faa32c166698b977884218c370ad20f8"
+    }
+  ],
+  "requiredWriterFences": {
+    "adminRecordMutationsHold": "active",
+    "g037WriteFreeze": "active",
+    "automaticReviewer": "stopped",
+    "browserRpc": "stopped",
+    "directSql": "stopped",
+    "dashboard": "stopped",
+    "providerIngress": "stopped"
+  }
+}

.github/review-media-evidence-prefixed-feature-successor.v1.json

@@ -0,0 +1,111 @@
+{
+  "schemaVersion": 1,
+  "id": "review_media_evidence_prefixed_feature_successor_v1",
+  "phase": "feature",
+  "purpose": "review-media-evidence-prefixed-five-stage",
+  "projectRef": "aqlcofblfxdrjhhdmarw",
+  "serverMajor": 17,
+  "databaseName": "postgres",
+  "executorRole": "postgres",
+  "advisoryLockKey": 7311754282260312,
+  "launchPolicy": {
+    "state": "held",
+    "code": "EVIDENCE_PREFIXED_FEATURE_LAUNCH_HELD",
+    "reason": "fresh-evidence-first-rehearsal-and-protected-admission-required"
+  },
+  "protectedSource": {
+    "remote": "origin",
+    "ref": "refs/heads/main",
+    "repositoryUrl": "https://github.com/twoimo/tzudong.git"
+  },
+  "stateRootAlgorithm": "review-media-ledger-identity/v1",
+  "operatingTransition": {
+    "before": 100,
+    "after": 105
+  },
+  "baseMapping": {
+    "path": "apps/web/performance/cross-audit-20261018/hosted-ledger-mapping-20261018.json",
+    "sha256": "7d504bcff6afc3008935dedf5978d3f576c8fbf0f2e8ea4ff55641e7c7b5ba0a",
+    "rowCount": 86,
+    "baseIdentityRoot": "394d3517244d79a673b0595dec0fefa40e6d8257b3762c27dd56a01cc198115d"
+  },
+  "historicalAppliedVariant": {
+    "version": "20261008124858",
+    "name": "public_profile_leaderboard_read_boundary",
+    "statementCount": 1,
+    "statementVectorSha256": "8bab7119608afa8cf4fec529fb5cab6546fbd0c9326e08b56c9a053daa21b360"
+  },
+  "evidenceMigrations": [
+    {
+      "version": "20261017043000",
+      "name": "evidence_frames_and_popularity",
+      "path": "backend/supabase/migrations/20261017043000_evidence_frames_and_popularity.sql",
+      "sha256": "d254fe76eb8c74587183bc89372891cd08a6a1cf92a99b8aa041497fa6ca7733",
+      "statementCount": 8,
+      "statementVectorSha256": "e8c4dbbe5fad3c9af301d5dfd0843417c3de148bbbddbde677c8b755ed6e45e4"
+    },
+    {
+      "version": "20261017140000",
+      "name": "restaurant_popularity_shadow",
+      "path": "backend/supabase/migrations/20261017140000_restaurant_popularity_shadow.sql",
+      "sha256": "fe0621f3a6f663beec2c14a60729ddbb17ba715205a114f24879af9b4dba11c6",
+      "statementCount": 3,
+      "statementVectorSha256": "6b1de5b932c1cf769436d5048fdde157127c7e5cb294c2b284ca63940995d16a"
+    },
+    {
+      "version": "20261017160000",
+      "name": "restaurant_popularity_shadow_tier",
+      "path": "backend/supabase/migrations/20261017160000_restaurant_popularity_shadow_tier.sql",
+      "sha256": "4ba19ee5b7ae3fbbfc4ffa00a93ed30e1197cd2ad1763e063a75f75158a48426",
+      "statementCount": 1,
+      "statementVectorSha256": "ed0eacead47eab1f9ceffacd0ab49abb035c40a7a7ecb1bacb19e34070088359"
+    }
+  ],
+  "targetManifest": {
+    "id": "review_media_feature_sql_successor_v1",
+    "manifestPath": ".github/review-media-feature-sql-successor.v1.json",
+    "manifestSha256": "360e5b56fd2214523ee5738eec94e1d77f9050f899dd243136abff3b6b1cb3df",
+    "sourceRoot": "960c276aa12a571c7a0c70261bcbaea61e668b5cb8872bd6f15e5bf577b04ab9",
+    "targetCount": 5
+  },
+  "operatingIdentity": {
+    "evidenceIdentityRoot": "37d598ad72fd4c0a057a34579e5c2053fc9a7a92645d8d045530890ad1034802",
+    "prefixIdentityRoot": "3bddf89c99ba6f4e635ed25c66451a92c23eaf95c2b387434978c04baad900d1",
+    "targetStageRoots": [
+      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "97271e80e3e79de33d26e9e79c1b5e6adb889b9780f119bb175c085eac5f6d0f",
+      "cc0991cb8359dc1aad086b27207a128d1c618deeb7aa7d1f32ef98cf42aba480",
+      "0e88d834ace4da6763191e6d1565f6126f402e5c832faf5cdbd4f49f215a6784",
+      "9842e3591bb87bf8cc4f19c7f5fdab2459bdea31c74290b61b18c66c5d4c0f50",
+      "a52c56662c26a3e2fca757b43f36103f4b1c265e25d3e3133881047f23a96332"
+    ],
+    "ledgerStageRoots": [
+      "3bddf89c99ba6f4e635ed25c66451a92c23eaf95c2b387434978c04baad900d1",
+      "7d4832d0aee15ebcfc22bba65dafa7593800535fb38823c89c2ba06be0d6f2ff",
+      "33e22b020343d42565ef14ddf19b9baf772c9b394387058b7b2397fcdeb94e1b",
+      "138f29125a170210f25cef3446cfa752c99612c324062ff7e81f173493e6ffba",
+      "6f4c133842fef1eb7e6f37d62cc1a8cce98a3974c44e1f619e6af8e5836af54f",
+      "3ef9d904fd9545027d39041483e5375e6d9c861f5f1a64a61c23b94df1146e4c"
+    ],
+    "terminalIdentityRoot": "3ef9d904fd9545027d39041483e5375e6d9c861f5f1a64a61c23b94df1146e4c"
+  },
+  "requiredWriterFences": {
+    "adminRecordMutationsHold": "active",
+    "g037WriteFreeze": "active",
+    "automaticReviewer": "stopped",
+    "browserRpc": "stopped",
+    "directSql": "stopped",
+    "dashboard": "stopped",
+    "providerIngress": "stopped"
+  },
+  "toolchain": [
+    {
+      "path": "apps/web/scripts/review-media-evidence-prefixed-sql-successors.mjs",
+      "sha256": "d76e45f0d3284d47a32231495409843b640f8107969ebf23814498f277827d3d"
+    },
+    {
+      "path": "apps/web/scripts/review-media-evidence-prefixed-feature-sql-successor.mjs",
+      "sha256": "1abc26c0bc4a2546f0e8930067a2d0e089d156b37ed5d160eee6a3e53e5ef618"
+    }
+  ]
+}