# V10 V3 Stage Rail channel

This package is the fail-closed boundary between V3 Stage authoring and a Rail
video program. It does not bundle a sample playlist, treat a Sequencer asset id
as video, or convert Calliope streaming plans into media URLs.

`StageRenderedMediaCookJob` reads explicit first-party/generated candidates,
requires recorded V3 authoring evidence and a passing `v3_concert_export`
report, invokes an injected renderer, hashes the returned video/audio/artwork
bytes, writes them through an immutable store, and requires delivery
verification to observe the same byte sizes and SHA-256 digests before a catalog
row can publish. Missing ports, blocked gates, malformed receipts, changed
bytes, unavailable playback, or a catalog-write failure produce a typed
rejection rather than usable media.

The separate `@oshun/v10-rail-channel-stage/release` entry point exports the
server-only durable candidate source, `V3StageRecordedReleaseGateAdapter`, and
`V3StageUnrealRenderer`. Keeping them out of the browser-facing root prevents
persistence, authoring/export, and Calliope dependencies from entering the Rail
UI graph. The release adapter consumes the authoritative Saraswati
authoring-editor state and `v3_concert_export` readiness types, fixes
item/version/concert identity, and requires every recorded authoring gate, the
published Sequencer receipt, full provenance attachment, and GA cadence to
agree. A ready export must carry a fresh exact-subject proof for every non-human
gate; expired, duplicated, substituted, or report-detached proofs fail closed.
If the suite requires human signoff, the exact fresh promotion and its canonical
`human_approval` proof are also required. Declared drills remain explicitly
blocked even when their structural planning gates pass.

`V3StageUnrealRenderer` consumes a strict binding from the owning V3 release
repository and rebinds candidate/version, concert, export hash, and published
Sequencer identity before invoking the small UE5.5 worker under a no-shell,
bounded host command. The worker renders one exact level, LevelSequence, and
camera. The adapter then independently requires an exact manifest, contiguous
declared PNG set, matching byte sizes and SHA-256 values, PNG dimensions, and
observable sequence variation. It enforces a configurable pixel-frame ceiling
and requires scratch capacity for worst-case RGBA frames plus reserve before
launch. It copies the digest-authorized audio source into the private job
directory, encodes H.264/AAC MP4 plus a separate AAC audio asset with real
FFmpeg, and requires FFprobe to observe the exact width, height, rate, frame
count, stream set, and bounded duration. Nonzero Unreal/FFmpeg/FFprobe exits,
symbolic-link aliases, undeclared files, static frames, forged metadata, and
changed audio all fail closed; the transient workspace is removed on every
outcome. The corresponding UE project lives at `V3/ue/StageRenderWorker` and
exposes a native compilation barrier so headless capture cannot succeed on black
placeholder frames while shaders remain queued.

`SqlV3StageCookCandidateRepository` is the durable cook source over the
canonical OSHUN PostgreSQL client. Immutable candidate revisions store exact V3
persona, concert, setlist, and track snapshots beside exact Calliope setlist,
camera, and streaming-plan snapshots. Publication validates recording authority,
one V3 persona, exact track coverage and duration, a bijective slot-to-track
join, and shared Calliope artist/concept/setlist/camera/venue identities. The
programming anchor must resolve to one real slot, camera coverage plan, and VOD
package; Calliope supplies energy, section, and perspective while a separately
cited editorial measurement supplies numeric cut density because Calliope models
that cadence as prose. A canonical SHA-256 binds the stored JSON projection.

Publishing is transactional and monotonically versioned. Exact retries are
idempotent, a newer revision supersedes the former current row, withdrawn or
superseded versions cannot be reused, and a PostgreSQL partial unique index
permits only one `ready` revision per candidate. Cook reads are bounded and fail
closed on a changed hash, row/payload identity disagreement, or conflicting
current versions. This source makes real inventory persistable; it does not seed
a candidate or turn a Calliope plan into rendered media.

`SqlV3StageRenderedCatalogRepository` is the durable handoff between the cook
and programming. It stores canonical SHA-256-bound rendered-item revisions in
the OSHUN PostgreSQL schema, publishes increasing versions transactionally,
accepts only exact active retries, and supersedes the former active row.
Withdrawal is terminal for that version. Database constraints and an update
trigger freeze item identity and JSON, require explicit retirement evidence, and
permit only one active revision per item. Bounded programming reads return only
due active items after revalidating the indexed artist/concert identity and full
item hash. The repository makes rendered inventory persistable; it does not seed
a catalog row or manufacture a media artifact.

`V3StageImmutableDeliveryAdapter` is the production storage/verification port
for that cook. It fixes every key below `live-media.v1/v3-stage/catalog/v1`,
uses the canonical shared create-only object-store contract, permits only the
Stage video/audio/artwork MIME matrix, and accepts an exact existing object only
as an idempotent replay. Before a receipt becomes catalog evidence it rechecks
immutable metadata, retrieves the credential-free HTTPS object with redirects
disabled, requires exact content type/length/SHA-256, enforces role-specific
byte ceilings, and invokes the real `FfprobeStageStoredMediaProbe` against a
private transient file. The verifier therefore proves the public bytes decode; a
storage `HEAD` alone is not playability evidence.

`compileStageProgram` accepts only those verified catalog rows. It filters
duplicate ids, ineligible rights, declared drills, failed exports, unavailable
assets, future evidence, and playback observations older than 15 minutes. The
remaining rows are scored against explicit daypart energy, set-section,
camera-perspective, and cut-density profiles. Player-face follows/favorites
shape the score; the spectator face remains non-personalized. Recent items are
penalized, ties use stable ids, and a stable program fingerprint replaces
shuffle. Empty or oversized-for-horizon input produces no program.

`publishStagePlayback` reads that catalog through its bounded port, compiles the
program, and offers the first item as a `first-party-vod` video source plus its
separately verified progressive audio through the Rail's coupled-media port.
Both halves carry one byte-derived identity, and the channel port exposes only
offer/withdraw; user-owned Rail selection creates one video holder and one
effective audio holder. Missing catalogs, empty programs, rejected lanes, and
forged receipts remain explicitly unavailable.

Concert slots are scheduled V3 Stage premieres. Their moment title, announcement
copy, and emitted payload say `premiere`; they do not claim a live source while
RB.4 remains absent.

`V3StageMediaPipelineJobControl`, `V3StagePublisherGrantControl`,
`V3StageViewerSessionControl`, `V3StagePlaybackGrantControl`, and
`V3StageProtectedPlaybackControl` are the tenant-#3 production authority seam
over `@oshun/live-media`. They fix tenant `v3-stage`, product-owned service
principals, the `v3.stage:<stream UUID>` external-resource mapping, and the
Stage player/immersive adapter identities after all injected options. This is a
control-plane composition only; it does not create a catalog row or a deployed
publisher/player host.

`createStageManifest` publishes calm spectator and player faces. The
`StageTileRenderer` reads an already-compiled program through an injected port,
revalidates its continuous schedule and exact face, and projects only the
verified current artwork/title plus up-next truth. Spectator programs reject
preference signals; player programs may expose the favorite/followed-artist
signal that shaped their order. Both faces degrade to the state-derived text
summary and request no tile motion.

The V10 web surface renders that projection as one artwork-led setlist and
handles selected `first-party-vod` holders with the browser's native progressive
video element. It mounts muted and paused, uses the exact holder URI, and calls
`play()` only from the explicit Play control. This UI is playback capability,
not catalog availability: the package still contains no seed playlist,
production renderer binding row, rendered Stage catalog row, or playable
fallback. The durable candidate/Calliope source, recorded-release,
immutable-delivery, catalog repository, and fail-closed Unreal render adapter
are now available, but a production binding, real first-party candidate/render,
deployed worker, and published catalog row still must supply evidence and bytes
before availability can be claimed.