Business Rules

Durable Rules

Production data backend selection is explicit and fail-closed: a PostgreSQL configuration failure must never silently fall back to local JSON.
Billing amounts use integer-fen arithmetic; wallet balance enforcement and ledger insertion happen inside the PostgreSQL billing_post_wallet_entry function.
Job claiming uses the PostgreSQL claim_generation_jobs function (FOR UPDATE SKIP LOCKED, lease, stale recovery); Go process-local locks must never replace it.
Ordinary members cannot submit generation when the organization balance is insufficient; submission is rejected before provider dispatch.
Super administrators calculate and record generation cost without checking, freezing, or refunding organization quota.
All new organization balance entries are organization-owned; generation charge/refund entries keep member attribution for consumption reporting.
Logged-in users may change their own password; account management and organization member actions require admin roles.
Public /api/v1 access authenticates with API keys and stays outside browser SSO middleware; API data is partitioned by the API account owner.
Database schema changes ship as versioned, checksummed, advisory-locked one-shot migrations; they never run in each Web pod init container.
Generated and uploaded assets remain runtime/object-storage state; PostgreSQL does not make them shared for horizontal scaling.

Whether Go must parse existing zhinian_session cookies without logout, or a one-time global re-login is acceptable at cutover.
The exact public /api/v1 compatibility promise to preserve during and after the Go cutover.

2026-08-14