Deferred fix: future-valued publishedAt remove = reschedule (drained-map re-arm)

[JustMaier]

The bug

The #335 trigger guard emits {op: remove, field: publishedAt, value: <future ts>} for scheduled posts. The ops processor ignored the carried value: on a deferred slot ANY remove of the schedule field = unschedule (slot leaves the deferred map, activates as draft — Tf activation destroyed); on a not-alive non-deferred slot the ops were memoized confirmed-deleted and dropped forever. July heal-era removes drained bitdex-1's deferred map through this path: ~93K scheduled images with NO activation path at their publish dates (earliest Aug 31). Found by the #3717 adversarial review; state confirmed empirically on bitdex-1.

The fix

get_future_schedule() reads a future timestamp from a Set OR value-bearing Remove on the deferred source field. Deferred slot → reschedule at that time (doc stores the schedule as a SET so activation replays a correct publishedAt). Not-alive non-deferred slot → re-ARM (before the confirmed-deleted memo — the future timestamp is what discriminates a drained scheduled slot from a deleted one). Null/past-valued removes keep unschedule semantics (genuine unpublish). PG-deleted rows can't reach the arming path (emission queries join live Image rows).

Why this also heals

Once deployed, one pass of the (currently gated) scheduled sweep in civitai #3717 re-arms every drained slot on both pods — the sweep becomes the standing repair mechanism instead of the thing that causes the damage.

Tests

3 new: reschedule-via-future-remove, past-valued remove still unschedules, drained-slot re-arm. Full --lib (server,pg-sync): 1317 passed, 2 pre-existing flakes (query_stream Win-timing; bound_store passes in isolation).

🤖 Generated with Claude Code

[JustMaier]

HOLD — do not merge. The adversarial sweep (2026-08-07) confirmed two criticals in this fix as written:

1. Dedup order-dependence: get_future_schedule's last-op-wins assumes op order, but dedup_entity_ops routes same-field value-bearing removes (reschedule = remove(OLD)+remove(NEW) in one row, no Set) through multi_value_net — an AHashMap whose iteration order randomizes which remove is 'last'. A reschedule resolves by coin flip; wrong pick = content publicly visible days early, or a reverted draft auto-publishing. Also deterministic mis-order when a Set is present (removes re-emitted before sets).
2. Fan-out deferred-reach path unpatched: apply_fanout_to_deferred_slots (queryOpSet path) still treats the guarded remove as an unschedule — this fix only covered the direct-op entrance.

Also confirmed major: future-only arming leaves past-Tf drained slots memoized confirmed-deleted (unhealable through the ops pipeline).

Redesign direction: resolve ambiguity at EMISSION (fan-out should not emit the old-side publishedAt remove — one unambiguous schedule op per row), plus patch both engine entrances, plus a past-Tf arming story. Full findings: docs/_in/adversarial-sweep-findings-2026-08-07.md (landing on main separately).