docs: brain final sign-off deltas — split version matrix (§10), quota rule E2, Post-v1 deferred items

Torch: no local 2.11 re-smoke (Space-on-2.11 verification is stronger); matrix
deliberately split local-2.13/Space-2.11. E2 formalizes the ZeroGPU quota gate.
subtalker_dosample UI logged as the one known 'every feature' gap for follow-up.

docs/DECISIONS.md

@@ -16,3 +16,4 @@
 | D8 | LoRA is per-request: adapter applied inside each generation fork, unloaded after; Clone gets an optional adapter field; Lab = inspect + self-contained quick-test. Supersedes D3's persistent toggle in the shipped app | ZeroGPU forks don't persist model mutations; parent-side attach fails ("Low-level CUDA init" under emulation); stateless = recycle-proof + kills global mutable state; ~1–2 s cost negligible | 2026-07-21 |
 | D9 | ZeroGPU deploy facts: no module-level preload (startup overrun) → lazy-load in fork; RAM watchdog darwin-only (psutil misreports in container); bind 0.0.0.0 + ssr_mode=False; torch==2.11.0 on Space; packages.txt sox/ffmpeg; LFS for binaries | Empirical — each item hit during T9 | 2026-07-21 |
 | E1 | Escalation: only real-money items (ZeroGPU credit top-ups, persistent storage) go to operator; **stay within PRO's included 40 min/day ZeroGPU quota** | Everything else delegated to brain-proxy | 2026-07-21 |
+| E2 | Stay within PRO's included 40 min/day ZeroGPU quota; paid credits forbidden without operator approval; Space verification runs batched + minimal; NO automated/scheduled Space tests (silent quota burn) | Operator hard-gate 2026-07-21; observed full-suite cost ≈ small single-digit GPU-minutes | 2026-07-21 |

docs/DESIGN.md

@@ -82,6 +82,8 @@ Layered: (0) env/version print + memory gauge sanity; (1) headless engine smokes
 ## 10. Pinned versions
 py 3.12; **torch==2.11.0 both platforms** (ZeroGPU patch-exact supported set {2.8.0, 2.9.1, 2.10.0, 2.11.0}; 2.13 kept only as a local scratch venv); transformers==4.57.3 (**5.x breaks qwen_tts**); qwen-tts==0.1.1; peft==0.19.1; accelerate==1.12.0; huggingface_hub<1.0; gradio 6.17.3; spaces (Space only). attn = **sdpa everywhere** (no flash-attn). `requirements.txt` = Space runtime; `requirements-dev.txt` = + playwright, pytest, psutil.
 
+The version matrix is **deliberately split**: local dev torch 2.13 (MPS-certified), Space torch 2.11.0 (CUDA-certified). Neither side changes without rerunning that platform's full suite; local torch changes additionally require re-running the certification trio (mel A/B, bit-exact seed check, 6/6 engine). The Space `gradio_client` suite is the sole cross-platform parity gate for any functional change.
+
 ## 11. Risks register (accepted)
 bf16-on-MPS numerics (mitigated: A/B smoke + fp32 contingency); torch 2.13 Space rejection (mitigated: pin ladder + re-smoke trigger); module-level cuda orphan regression (mitigated: fork_move flag + device-log acceptance); adapter key-prefix mismatch (mitigated: inspect-first + remap); Space cold-boot re-downloads ~14 GB (accepted: private personal Space; persistent storage = money = operator call); streaming absent (accepted: wrapper limitation, documented).
 

docs/PLAN.md

@@ -34,8 +34,16 @@
 ## Cross-cutting rules
 Commit at least per-task, push regularly; long runs = background shells with monitoring; watchdog active in every model-touching run; never a second model-holding process; on the 2nd failed fix of any bug — stop patching, bring it to the brain for first-principles review; MPS↔CUDA outputs are never bit-compared.
 
-## Post-v1 verification (non-blocking; do cheaply, no redeploy pressure)
-Both hard gates are met and the Space is verified 5/5. Remaining low-priority checks (mind the 40 min/day ZeroGPU quota — spend a minute, not more):
-1. **D8 A/B regression** — add one fixed-seed adapter-on vs adapter-empty pair to the Space `gradio_client` suite; assert the two differ (the per-request LoRA guarantee, regression-tested where it ships).
-2. **Worker-persistence / quota math** — run a 3-consecutive-same-mode burst on the Space; if calls #2/#3 aren't faster than #1, models reload per call and GPU-seconds/request must be re-costed against the 40 min/day budget. State the true behavior in DESIGN once measured.
-3. **In-fork device log** — one-time: emit `next(model.parameters()).device` inside a `@spaces.GPU` handler and confirm `cuda:0` (functionally implied by working generations; cheap to make explicit).
+## Post-v1 (non-blocking; deferred by design — mind the 40 min/day ZeroGPU quota, E2)
+Both hard gates are met and the Space is verified 5/5. Deferred, in rough priority:
+
+**Feature / polish gaps:**
+1. **`subtalker_dosample` UI exposure** — the one known gap against the "every feature" mandate; smallest possible scope; first in line for any follow-up session.
+2. Dynamic-`duration` callable (queue-priority polish; does NOT affect quota — quota = effective runtime × size multiplier, not declared duration).
+3. int16 mic-input scaling consistency (scale by dtype, don't peak-normalize).
+4. Residency hysteresis (re-expand < 55 GB) + status-strip eviction visibility.
+
+**Verification checks (do cheaply, ≤ 1 GPU-min each):**
+5. **D8 A/B regression** — fixed-seed adapter-set vs adapter-empty pair in the Space `gradio_client` suite; assert they differ.
+6. **Worker-persistence / quota math** — 3-consecutive-same-mode burst; if #2/#3 aren't faster than #1, models reload per call → re-cost GPU-seconds/request vs the 40 min/day budget; state the true behavior in DESIGN once measured.
+7. **In-fork device log** — emit `next(model.parameters()).device` inside a `@spaces.GPU` handler; confirm `cuda:0`.