# Publication Guard Fact Preservation

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "publication-guard-fact-preservation-2026-08-06",
  "problems": [
    {
      "problemId": "publication-guard-replaces-validated-observations-with-generic-text",
      "summary": "When workload identity or causality wording still failed after one correction, the fail-closed publication result replaced independently validated scenario observations with a generic response.",
      "status": "optimized_verified",
      "issueKeys": ["ST-2864", "TCID-13001"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/ST-2864#problem:publication-guard-dropped-tiflash-observations",
        "https://tidb.atlassian.net/browse/TCID-13001#problem:publication-guard-dropped-multi-source-observations"
      ],
      "signalTextIncludesAny": [
        "publication guard dropped validated facts",
        "generic causality fallback replaced scenario observations",
        "final answer lost admitted evidence"
      ],
      "observedThrough": "2026-08-06",
      "effectiveAt": "2026-08-06T08:59:29Z",
      "verifiedAt": "2026-08-06T09:20:42.247Z",
      "attemptedAction": "Keep the fail-closed human-required decision and causal boundary while deterministically carrying only validated scenario observations into the fallback reply; never preserve the rejected causal sentence itself.",
      "evidenceUrl": "https://pingcap.feishu.cn/docx/SDHAdVVOXoCCfJxpduOcX2hKnAh"
    }
  ]
}
-->

- Optimization ID: `publication-guard-fact-preservation-2026-08-06`
- Owner: auto-oncall-services
- Source references: post-deployment `ST-2864` and `TCID-13001` replays
- Implementation status: deployed to staging in image
  `ccdf46c1d66ffa98c2ea6eb86b09ba5a3c5b3add`; the change remains present in
  live descendant image `918c503fcbb63224521eb32d06d3b06d24367bb2`
- Effective status: `optimized_verified`

## Bounded problem

The causal guard correctly rejects unsupported workload attribution, but its
last-resort result currently discards unrelated observations that already
passed the scenario evidence schema.

## Common-sense invariants

- A rejected causal claim must never survive the fallback.
- Independently validated observations must not disappear only because causal
  attribution is unresolved.
- The fallback may use only validated packet observations, never raw provider
  output or the rejected prose.
- The decision remains `human_required` and the missing identity/causality
  boundary remains explicit.
- When no validated observation exists, preserve the current generic fallback.

## Verification status

The fail-closed result now carries at most five unique observations from the
validated scenario packets. It filters any observation that contradicts the
typed workload-identity boundary, never copies the rejected result prose, and
keeps the current generic fallback when no safe observation remains.

Runner tests cover initial correction failure, post-normalization boundary
loss, a contradictory corrected surface, and a packet observation that itself
claims an unsupported root cause. The complete repository suite passes
658/658.

Post-deployment write replays passed the bounded criterion:

- `ST-2864` run `3159a61c-76e4-4b7f-af1a-6a18ca2408eb` / DB run `120037`
  preserved that all three TiFlash instances had 32 logical cores, that
  coprocessor requests spiked, and that the observed proxy CPU peak did not
  prove saturation. It still rejected a confirmed resource-saturation or
  workload cause.
- `TCID-13001` run `b79fac99-abbf-4f59-901a-a6cc8d642cf6` / DB run `120039`
  preserved the three-instance DDL-duration observation, heavy TopSQL
  candidates, two-to-three-minute Slow Query records, and increasing query
  volume. It still rejected a concrete write root cause without typed
  transaction and causal mapping.
- Control `ST-2863` run `4149d6ad-c641-4439-866e-d4f8dd9bb3bc` / DB run
  `120041` retained the already-established direct mechanism: TiFlash RSS of
  about 4.76-4.78 GiB exceeded the 3.76 GiB data-computing limit. The guard did
  not degrade that supported mechanism into generic text.

The existing Jira internal comments were updated in place and read back as
HTTP 200 with `public=false`: `ST-2864` comment `23430476`, `TCID-13001`
comment `23428753`, and control `ST-2863` comment `23422952`. No duplicate or
customer-visible comment was created.

The `TCID-13001` replay also used the separately deployed Essential Slow Query
NGM routing change from `tidbcloud/aisupport#661`; its successful Slow Query
artifact must be attributed to that optimization, not to this publication
guard record.

## Unresolved gaps

- `TCID-13001` fact preservation is correct but the fallback draft exposes
  English evidence prose and internal artifact paths. That presentation issue
  is outside this bounded fact-retention criterion.
- The decision reason remains deliberately fail-closed and states that typed
  workload identity or causality was not preserved. Improving its wording must
  not weaken the boundary.

## Next validation action

Monitor later publication-guard replays for either loss of admitted facts or
reintroduction of unsupported workload identity. A newer matching signal is a
regression; it must not be suppressed by this verification record.