feat(core): let the first assertion of an unclaimed cid take the claim until content auth turns strict

[rickyrombo]

Rebased onto main now that #574 has merged. Must be in the bootstrap build alongside #572.

Why

validateTrackContentAuth had three outcomes: claimed by you, pass; claimed by someone else, reject; claimed by nobody, reject. The third one breaks the migration. The API's new-chain flusher resubmits every post-snapshot write through ForwardTransaction, which validates like a live write, and it does not advance past a refused row. Every track created on the old chain after the snapshot names cids nobody attested — old-chain mediorum never does, and the replay only seeds the snapshot's tracks — so the queue stalls at the first one and step 12 of the runbook never becomes reachable. Around 429 track creates a day fall in that window.

What

A first-assertion window, bounded by a new upgrade height. The scheduler has no end height, so ContentAuthStrictHeight is a second gate over the same rule (Rules.ContentAuthStrict):

• Enforced, not yet strict: a cid nobody holds passes, and the projection records the writer as claimant (projectAssertedTrackCids), the same thing the migration replay does for its rows. From then on the cid is that user's alone; a second user naming it is refused with was not uploaded for user.
• Strict: a cid nobody holds is refused with is not attested to any uploader, and live writes claim nothing. This is the pre-PR behavior and the steady state.

The resolved config.Rules is passed into applyAuthProjection and validateTrackContentAuth alongside the transaction (it is a property of the height, not of the transaction, so it is not a field on authTx), and both read ContentAuthStrict directly. Validation only runs under ContentAuthEnforced; the projection runs for every live write, so it checks enforced explicitly too.

Why the window must close. The upload row is public on GET /uploads while it transcodes, so orig_file_cid is readable before any attestation exists, and the attestation transaction is visible in the mempool before it lands. A ContentAttestation does not project into the proposal overlay, so a create naming the cid passes validation whichever side of the attestation it sits in the block, and the writer ends up with an indexed track naming someone else's audio — the decoy content auth exists to prevent. That is acceptable only while the flusher needs it.

What does not change.

• A cid someone holds is still refused at validation, and projectAssertedTrackCids never reassigns a held cid at finalize, so a block from a proposer without the gate cannot transfer one by naming it.
• Claims from live writes are recorded only inside the window. Before the enforcement gate a chain accumulates nothing from live traffic, preserving feat(core): authorize track cids against validator upload attestations (unsigned attribution) #477's principle that pre-enforcement state is never trusted.
• Track updates project only this claim, and only after the same signer-authority check a create gets.

Schedules. Devnet and sandbox are strict from height 1, so local chains and integration tests exercise the steady state; the window is covered by unit tests. audius-mainnet-beta (added by #572) needs ContentAuthStrictHeight set in a follow-up release as soon as the flusher has drained, and never before, or the first refused row stalls it.

Residual flusher stall, not addressed here. A post-snapshot track whose cid is already held by a different user (duplicate bytes, or a re-upload of a pre-snapshot track) is still refused. The flusher should skip and log a refused row rather than halt.

Verification

• make test-unit green. New: TestContentAuthStrictCloseWindow (config), TestStrictContentAuthRejectsUnattestedCid, plus the existing TestContentAuthUnattestedCidGoesToFirstAsserter, TestAssertedClaimNeverOverridesAnExistingOne, TestPreGateLiveTrackClaimsNothing, TestUpdateClaimsUnattestedCidOnlyForAuthorizedSigner.
• make test-integration on a devnet built from this branch: all eight TestContentAuth cases green, with UnattestedCidIsRejected restored since the devnet is strict from height 1.

🤖 Generated with Claude Code