[P2][Deferred][Manim] production durable RenderSessionをfreezeし退役する

[Hosi121]

Parent / dependencies

• Architecture decision: [P1][Architecture] SaaS platformの語彙・集約・quota模型を再導出する #702 / ADR 0005
• Local export cutover: [P1][Sub-Epic][Export] Rust/WebCodecs client export・publicationへ移行する #693
• Active local-product milestone: [P0][Epic][Local Product] Studio-native 2D表現力を拡張する #921

Decision — 2026-08-19

RenderSession is not the canonical preview/export architecture and will not receive a successor aggregate.

Consumer	Decision
.py export	KEEP as an independent Manim adapter capability; it does not depend on RenderSession
local/Vite/Electron real-Manim preview	KEEP temporarily as an optional authoritative oracle for imported Manim
local preview cancel/discard/video	KEEP with the local in-memory manager
source commit/undo	REMOVE without a successor; non-destructive .poietra.py export + re-import is the supported loop
new production durable RenderSession	FREEZE for every project origin
existing durable session read/video/actions	KEEP only for drain
PostgreSQL session/artifact/retention machinery	REMOVE after historical drain
SourceCommitTransaction / ExecutionJob replacement	DO NOT BUILD without a newly approved production consumer

This keeps local product work moving while preventing the SaaS path from accumulating more ownership around a legacy aggregate.

Current state

PR #737 froze Studio-native session creation in the UI capability layer. Production durable start() can still create rows: mainのAPI ingressにはmanager.start()呼び出しが2経路残っているため、freezeはまだ完了していない。

Minimal implementation when this deferred task resumes

One small freeze PR:

• reject production durable RenderSession creation before source reads, blob writes, or quota reservation
• use an explicit server-render-retired-style reason
• do not change the local ManimRenderManager
• preserve existing production read/video/action paths only for historical drain
• add no SQL trigger, migration, replacement aggregate, or compatibility framework

Later cleanup, after drain:

• remove source commit/undo UI and mutation APIs
• remove durable worker/repository/retention/table ownership
• keep .py export independent
• delete the compatibility lane rather than migrating it

Exit criteria

• Studio UI does not start a new native RenderSession
• every consumer has a keep/freeze/remove decision
• no generic successor table is planned without a caller
• production API rejects every new durable RenderSession before side effects
• source commit/undo is removed after the non-destructive local export/re-import flow is confirmed
• historical durable sessions are drained and the storage path is deleted

Scheduling

Deferred until the active local-product Epic #921 is complete. It does not block local preview, local WebCodecs export, or the current local-product milestone.

Non-goals

• changing local imported-Manim preview behavior now
• moving Python/source safety rules into Rust core
• adding a new state machine, table, or migration for an unapproved consumer

[Hosi121]

Consumer inventory — 完了報告（2026-08-16）

全consumer・全テスト・freeze挿入点を棚卸しした。結論と証拠の要約（詳細な行番号は本文中）。

構造的発見（freeze設計を決定づける2点）

1. render_sessionsへのINSERTはrepo全体で1箇所：postgres-render-session-repository.ts:905-937（createSession内）。local/Electron laneのManimRenderManagerはin-process MapのみでDB行を作らない——Electronはfreezeのスコープ外。
2. durable storageにlane判別子が今日存在しない。workspace_projectsにkind/origin列なし、native starter作成とimportedは同じcreateManagedProjectに合流し同じ.py blob + source headで終わる。render requestにもorigin fieldなし。⇒ 精密なfreezeは#710のorigin列がhard prerequisite。#710前に可能なのはglobal kill-switchのみ（別のdecision）。starter-digestヒューリスティックは初commitで壊れるため不採用。

Freeze guardの挿入点（推奨: A + B + D、origin = 'studio-native'で判定）

#	位置	判定
A	durable-manim-render-service.ts start()冒頭（:151より前。orphan blob cleanup経路も回避）	主guard
B	durable-manim-runtime.ts start() :562-568 ＋ #renderCapability :356-374に新unavailableReason（UIが409でなくgrey-outになる）	capability広告
D	createSession transaction内、source headロック(:855-875)後・usage reservation(:898)前（拒否がquotaを消費しない位置）	最終防衛線
C/E	HTTP層guard / SQL trigger	不採用/退役migration送り

隠れた結合（ADR/既存Issueに未記載のもの）

1. durable thumbnailはrender sessionの純粋な副産物。workspace_project_thumbnail_headsの唯一のwriterはpostgres-artifact-repository.ts:430-442（render完了時）で、generateThumbnailはno-op（durable-manim-runtime.ts:509-511）。native renderをfreezeするとnative thumbnailの生産者がゼロになる——#695の真の依存。
2. frozen-but-not-drainedなnative sessionはproject削除を永久にブロックする：workspace_project_references (reference_kind='render-session')が残る限りpostgres-workspace-source-repository.ts:626-633が409。drain計画が必須。
3. project_png_generationsの保持はrender session行をpinに使う（6箇所のsubquery）。render_sessions.project_png_generationを落とす前にre-homeが必要。
4. usage_reservations.operation_kindは= 'render'の単一literal CHECK（0014:51,100）＋v15 triggerがINSERT時にrender reservationを強制。billing v2のoperation_kind拡張migrationが全meteringの前提。
5. render_artifact_objectsのNOT NULL digest壁（runtime/profile/request）はsandbox executor由来——client exportがこのテーブルを再利用できない理由の確認（→ #725のclient_export_*新設が正当）。
6. render session wire viewはx-poietra-render-session-version（legacy/2/3）でnegotiate済み——freezeで形を変えるならこの軸を再利用し第4の軸を作らない。
7. reference_kind = 'render-job'は死語彙（0001:70）——退役migrationで掃除。

commit/undoの後継（retire vs 最小SourceCommitTransaction）

最小後継に移す必要があるのは2つだけ：(1) workspace_source_headsのgeneration CAS（:1512-1528）、(2) actionIdキーの冪等apply/revert（:1454-1478）。render_source_actionsの残り（session-version CAS、commit_correlation_key、transition legality、per-session cap）はrender sessionへの融合ゆえに存在する付属物。standalone版のkeyは(sourcePath, expectedGeneration, expectedDigest, candidateDigest)のtupleでよい。retire時の副作用として注意：videoUrlはstatus ∈ ready|committed|undoneに依存（durable-manim-render-service.ts:83-86）、local laneのthumbnail自動更新はcommit成功のみがトリガ。

テスト棚卸し

• Group A（freeze後も不変）：policy/mutation-transaction/worker/cancellation/retention/artifact系 約18ファイル
• Group B（freeze時に更新）：durable-manim-render-service.test.ts（native拒否＋imported維持の新ケース）、postgres-render-session-repository.test.ts（拒否がreserve前であること）、manim-render-http.test.ts、capability enum系（render-pipeline-policy.test.ts / client.test.ts）、fixtures、e2e/preview-renderer.e2e.ts（9箇所のmock）
• Group C（退役時のみ消滅）：mutation-transaction全体、commit/undo系ブロック、lease/fence/cancellation/retention各ファイル、migrations 2/5/6/7/8/9/15/19のassert

Freeze PRスコープ（#710 merge後に実装）

• contract：ManimRenderCapability.unavailableReasonへ"native-render-frozen"をadditiveに追加（既存payload byte不変）
• server：上記A（~15行）＋B（~20行）＋D（~10行）
• client：renderCapabilityBlockerに1分岐（~3行）
• migrationなし・route変更なし・新テーブルなし（ADR 0005 §render session split準拠）
• 同PRでGroup Bテスト更新
• freeze PRが起票すべきfollow-up：native thumbnail生産者の空白（#695ブロッカー明記）／frozen native sessionのdrain計画／render-job死語彙掃除／commit/undo存廃decision