Admin release: live-data verification
Verified September 12, 2026 Pacific, finishing September 13 00:06 UTC. The release branch includes main through 4c362c546. Application deployment, admin exposure, capture and Free-credit activation remain held. No new production migration, restart, credential change or report publication occurred in this pass.
Reconciliation
The historical comparison ends at September 12 00:00 UTC, exclusive. It includes retained records before April; April 1 is a chart display boundary, not a deletion of earlier statistics.
| Source | Verification | Result |
|---|---|---|
| Neon credit ledger → ClickHouse | 4,125,659 entries; 1,371 day/type groups; counts, two ID fingerprints, signed amounts and absolute amounts | No differences |
| Neon usage → ClickHouse | 4,939,868 records; 32,444 day/endpoint/billing-tier/model groups; counts, two ID fingerprints, input/output tokens and known-cost counts | No differences |
| Corporate Stripe → warehouse | 3,275 balance entries, compared individually by ID, timestamp, charge link and every normalized financial field; raw Stripe net independently conserved | No differences |
| Legacy Stripe → warehouse | 324 balance entries, same checks | No differences |
| OpenRouter → warehouse, April 1 onward | Account usage total and 163 daily buckets | $70,945.836551, matching both |
The PostgreSQL scan used one direct read-replica connection, 8 MiB page ranges, a six-second statement deadline and a pause between batches. A long standby snapshot was canceled by recovery; the successful run used independent read-only batches over the closed historical range. It is not an atomic MVCC snapshot. A post-scan comparison found no group differences. This audits retained history, not records deleted before replication began.
OpenRouter also has $0.890396 before April 1. The dashboard's All time cost therefore correctly shows $70,946.726947 through this cutoff. The April-onward graph and comparison exclude that amount. No second cache discount is applied.
Both Stripe accounts together contain $45,713.18 of gross receipts and $45,221.69 after refunds, disputes and actual cash fees at this cutoff. Fee credits are accounted for separately. Three corporate payments totaling $15 have known products but no user identity; they remain included in revenue and explicitly unmapped for customer attribution. No guessed identities were assigned.
The ClickPipe remained Running. Web and game-runtime health endpoints returned 200, with the web confirming its primary database, read endpoint and Redis.
Report fixes verified
- Historical customer-economics and funding queries exceeded the worker's existing 1 GiB query ceiling. Their joins and aggregations now spill in bounded partitions. Funding aggregates by person before expanding origins and skips cost denominators for requests whose cost is unknown. No service memory limit was raised.
- The optimized historical flow exactly matches the previous allocation across 101 origin/destination paths, including Mushie values and cost/null status. It remains an allocation model, not an exact historical wallet-lot trace.
- A finance report ending at UTC midnight now excludes the next day's provider bucket. A real ClickHouse fixture places a large charge in that next bucket to verify exclusion.
- Acquisition and age bands now come from the same population query. Separate queries produced a one-account mismatch during live updates. The shared query removes that disagreement and one query per period.
- Common queries are reused within one report refresh, with an 8 MiB cache budget. New refreshes get a new cache; failures, cancellation and oversized results cannot become reusable successful responses.
- The worker refreshes Overview between slower detail jobs. It schedules from the start of a refresh and shortens the following sleep when needed. Queries remain sequential. Admin requests continue to read prepared Redis snapshots and never trigger warehouse or Neon scans.
- Cursor versions normalize either numeric or quoted UInt64 JSON before arithmetic. The live service currently returns numeric versions; the change also handles the other ClickHouse output format without concatenating version digits.
Real-data report sweep
All 21 report/period combinations passed using the real canonical CDC views and vendor facts, with read-only, process-local coverage cutoffs. No source cursor, heartbeat, production report or Redis snapshot was changed for this rehearsal. Playtime coverage was deliberately left unavailable.
| Report | Periods | Background build time across periods | Warehouse queries | Largest JSON snapshot |
|---|---|---|---|---|
| Overview | All, 1D, 7D, 30D, 90D | 41.0 s | 45 | 19.3 kB |
| Finance | Same five | 98.2 s | 59 | 23.5 kB |
| Tokens / funding | Same five | 153.7 s | 20 | 33.6 kB |
| Worlds | Same five | 66.4 s | 40 | 651.6 kB |
| Retention | All, containing daily/weekly/monthly cohorts | 16.7 s | 8 | 11.5 kB |
These are background computation times, not navigation latency. All five Overview periods previously took 68.0 seconds and 90 queries in the uncached rehearsal; the revised pass took 41.0 seconds and 45 queries. Funding is still the slowest historical computation, at approximately 24–38 seconds per period. It runs on its slower refresh schedule while Overview gets priority between detail jobs. Serving has a 250 ms cache deadline and last-good fallback; deployed latency must still be measured after the approved release.
Tests and build
- Full monorepo typecheck: 8/8 tasks passed. Production build: 5/5 tasks passed. Existing frontend chunk-size warnings remain.
- Focused analytics suite: 28 passed, three environment-dependent tests skipped in that invocation. The warehouse and CDC integrations were separately run against disposable ClickHouse databases and passed, including updates/deletes, coherent audience denominators, cash conservation, missing costs, split debits across a cutoff, transfers and midnight exclusion. Those databases were removed.
- The rebuilt worker ran on Node 22.23.2 in Linux, using the existing verified runtime image with the current compiled output mounted read-only. Against disposable local ClickHouse and Redis it published all 21 fixture snapshots, restored them from durable storage after cache loss, and preserved a replacement worker's lease. This verifies the new compiled code; it is not a newly published image or a production launch.
- The temporary fixture containers were stopped, the local VM shut down and its transfer helper stopped. No production services were stopped.
Remaining release gates
Historical request costs were not recorded in any of the 4,939,868 retained usage rows in this audit. The account-level OpenRouter bill is reconciled; exact historical cost per user, model or credit origin cannot be recovered from these rows. Missing cost stays unavailable, never zero or an inferred list-price bill. Historical foreground playtime is also unavailable. The approved capture release must establish those measurements going forward.
The live web and game runtime still have capture, admin analytics and Free-policy variables unset. The analytics worker still has ANALYTICS_CDC_READY=false and no application database connection. Initial copy reconciliation is complete, but enabling worker readiness still requires the genuine source heartbeat and new capture path to be verified during the separately approved application release.
The production Bonus installer and revised recovery function remain unapplied. Apply them in the reviewed compatibility sequence, verify the compatible replicas and then activate only the independently approved switches. The owner publishes the announcement personally. Keep a full week's notice for existing users; September 21 04:00 Shanghai remains the proposed check-in cutoff only if that notice requirement is met.
No new account, service, billing setup or credential submission is needed from the owner. The remaining owner decisions are the release window and the notice/activation times.
Local evidence is ignored under packages/server/scripts/admin-analytics.local/: history-*-comparison.local.json, stripe-reconciliation.local.json, provider-reconciliation.json, flow-parity.local.json, final-reconciliation.local.json and report-audit/. The compiled-worker result is packages/server/scripts/admin-release.local/vm/worker-final-rehearsal.log.