feat(ai): centralize durable usage

Add a content-free usage ledger with legacy backfill. Reserve Workspace and durable Strategy/CV work before execution so deleted history or duplicate admission cannot reset limits.
2026-08-15 20:03:06 +02:00
parent dbff0f8d49
commit 134aac7bcf
28 changed files with 3539 additions and 83 deletions
@@ -789,3 +789,13 @@
 - **Consequences:** generic operations remain independent; the one existing persisted subject projection is synchronized through a narrow task/subject check with an explicit owner predicate.
 - **User approval required:** No; local consistency fix with no schema, dependency or production change.
 - **Reversible:** Revert the store helper/tests. No stored format changed.
+
+## DEC-080 — Separate durable AI usage from user-visible history
+
+- **Date:** 2026-08-15
+- **Decision:** Store content-free AI usage in an append-only owner ledger keyed by source. Reserve allowance before AI Workspace work and atomically with Strategy/CV operation creation; replace conservative reservations with actual character-based estimates where complete output metadata exists. Backfill legacy `AiInteraction` counters without copying prompts or generated text.
+- **Reason/evidence:** `AiInteraction` is private, user-deletable history and covered only one feature, so deleting history reset plan usage while durable Strategy/CV calls were invisible. Real SQLite tests prove idempotence, tenant isolation, limits, history-independent totals, Strategy finalization, CV reservation, export/deletion handling and legacy backfill; fresh application startup reaches the new migration.
+- **Alternatives considered:** retain `AiInteraction` as the meter; add counters to every feature table; estimate only after success; persist prompts/results in a billing record. These couple enforcement to deletable content, scatter one policy across unrelated schemas, permit unbounded concurrent admission, or duplicate private material.
+- **Consequences:** monthly usage is stable across history deletion and duplicate durable admission. CV remains conservatively reserved until complete multi-stage telemetry exists. Older synchronous AI actions still require the same admission seam before limits are universal. The process-local reservation gate is sufficient only for the current single-backend topology.
+- **User approval required:** Production migration/rollout only. The additive repository migration and synthetic tests do not change production.
+- **Reversible:** Disable AI work, downgrade the additive migration only after preserving any required usage evidence, and restore the prior interaction-based display. Existing user content is unchanged.