Stack

Stacked on #325 (feat/per-image-fanout) — this PR targets feat/per-image-fanout, not main. It depends on #325's fan_out_per_row / shared_ops_fields trigger_gen types and will need to be re-targeted at main (or merged after) once #325 lands. Do not merge before #325.

Implements W2-1 (#8) of docs/design/scheduled-publish-execution-plan.md.

Summary

• deploy/configs/sync-config-civitai.yaml:
  • Post trigger: type: fan_out → fan_out_per_row (rows_from: {table: Image, fk: postId}), retaining track_fields: {publishedAt, availability, postedToId} ([PR-M1] — publishedAt drives both deferred-alive activation stamping and the isPublished shadow; only Phase 2 ever removes availability/postedToId).
  • Image trigger: + sortAtUnix via shared_ops_fields (milliseconds, * 1000, COALESCE(GREATEST(...)) belt — byte-identical to W1-1's SORTATUNIX_EXPR), + model3dId computed_field (INSERT-read Post subselect; not carried on the Post fan-out — model3dId is set at post-create before images exist, so INSERT-read alone suffices; reasoning documented inline in the config).
  • Dump images phase: copy_query gains a type-correct sortAt epoch-seconds column ([PR-B3] — all GREATEST/COALESCE operands are TIMESTAMPs, extract(epoch from ...)::bigint wraps the whole expression, never COALESCE(timestamp, bigint)); posts enrichment gains the model3dId column + field mapping.
• deploy/configs/civitai-index.yaml:
  • sortAt sort field: removed the computed: {op: greatest, source_fields: [existedAt, publishedAt]} block ([PR-M5] — same-deploy as the emission flip; computed and ingested must never coexist).
  • + model3dId filter field (single_value, per_value_lazy) + data_schema entry.
  • Verified sortAtUnix → sortAt data_schema mapping intact (ms_to_seconds: true, fallback: sortAt).
• Deleted stale deploy/configs/prod-sync-config-civitai.yaml — behind the canonical sync-config-civitai.yaml since the 2026-07-07 Mode B fix; prod-sync.toml mounts sync-config-civitai.yaml, and grep found no code/operational reference to the stale copy.
• Regenerated docs/design/trigger-sql-review.sql (test-generated artifact).

[PR-B4] Units verification (must-verify before cutover)

Pinned statement (also written into both config files as comments):

sortAtUnix is emitted in MILLISECONDS; the data_schema sortAtUnix → sortAt mapping (ms_to_seconds: true) divides by 1000, so the sortAt SORT LAYERS store SECONDS. The dump emits a sortAt column already in SECONDS via fallback: sortAt (a fallback source is NOT ms-converted). A query sortAtUnix Gte <seconds> clause resolves ONLY through time_buckets (filter_field: sortAtUnix → sort_field: sortAt): the threshold is unit-normalized by ts_secs_u64 (already seconds, passes through unchanged) and snapped to a bucket built from the sortAt seconds layers. No ingested sortAtUnix filter field exists. Seconds everywhere on the query side; ms only on the wire. The Civitai builder's seconds-Gte (image.service.ts:3940) is CORRECT both before and after this change.

Evidence (file:line):

• (a) Which field the clause hits: the sort layers via time-bucket, not a filter field — src/executor.rs:668-690 (Gt/Gte bucket-snap gated on field == tb.field_name()), src/cache_worker.rs:575 (bucket membership derived from tb.sort_field_name() = "sortAt").
• (b) Units: seconds — src/time_buckets.rs:189-196 (cutoff/now arithmetic in seconds), threshold normalized at src/query.rs:316 (ts_secs_u64).
• (c) Does the period filter work TODAY (sortAtUnix emitted by nothing): YES — buckets are populated from the sortAt sort field (today: engine-computed via GREATEST), the sortAtUnix name is only the clause label matched against tb.field_name(). Whether sortAtUnix is ingested is irrelevant to the query path.
• (d) After our change (emission ms → mapping ÷1000 → layers seconds): unchanged — sortAt seconds still feed the layers (now ingested instead of computed), seconds-Gte remains correct.
• Config refs: civitai-index.yaml time_buckets block (filter_field: sortAtUnix, sort_field: sortAt) + data_schema sortAtUnix → sortAt entry.

Caveat (pre-existing, unchanged by this PR): a non-snappable sortAtUnix Gte (duration outside the 10% tolerance of every configured bucket) falls through to range_scan("sortAtUnix"), which returns FieldNotFound since no such filter field is ingested. In practice the Civitai builder only sends period thresholds aligned to the 24h/7d/30d/1y buckets, so this hasn't surfaced — flagging for W3/W4 awareness, not fixing here (out of W2-1 scope).

Tests

src/pg_sync/sync_config.rs, all loading the real deploy configs:

• test_post_fanout_disjoint_from_sortatunix — Post-fan-out ∩ Image-trigger emitted fields == exactly the intentional Mode-B overlap {publishedAt, availability, postedToId}; sortAtUnix/model3dId strictly disjoint (the actual op_dedup LIFO hazard named in [PR-m2]).
• test_image_sortatunix_emitted_ms_on_deploy_config — ms units + shared-function call present on the real config.
• test_index_config_sortat_ingested_and_model3did — no computed: block, mapping semantics, model3dId wiring.

cargo test --lib --features pg-sync (skipping test_min_tracked_value_after_expansion, known deadlock): 1249 passed, 8 ignored, 0 failed.

Notes for reviewers

• The literal W1-1-review-minor-3 disjointness wording ("Post fan-out track_fields ∩ Image trigger emitted fields = ∅") is unsatisfiable given PR-M1's retained payload — confirmed with the plan coordinator that the implemented invariant (overlap == exactly the Mode-B set; sortAtUnix/model3dId disjoint) is the intended reading.
• model3dId as a Post column confirmed by the coordinator against prisma/schema.prisma in model-share (model3d-visible-ids-batch.test.ts:6).
• Does not touch talos-infra (mirroring happens at W4 deploy, per plan).

🤖 Generated with Claude Code