Retire local-fallback-v1 printing votes as redundant with stage-d-fallback-v1

[WilfordGrimley]

Retires local-fallback-v1 as a printing-vote identity, keeping stage-d-fallback-v1. Owner ruling 2026-07-29, redundancy doctrine — anything made redundant is retired, judged on the evidence source, not the vote cast. Two calculators reading one underlying signal are one witness counted twice, inflating apparent corroboration in vote_consensus.resolve_weighted_consensus' weighted quorum (machine weight 0.5, PRINTING_TAG_MIN_VOTES 2.0) without adding information. The same ruling already retired local-ocr-v1 against stage-d-join-key-v1.

1. The premise was verified in code before anything was changed

The measurement (11,825/11,825 overlapping cards, 100.0%, zero conflicts, zero one-sided abstentions, over all 179,176 CardPrintingTag rows) is consistent with two hypotheses: same evidence source, or artefact (one calling the other, or both cast by a shared command). It is the former.

Same decision model. local_calculate_verdicts.calculate_fallback_verdict is a faithful port of local_fallback.run_fallback_for_card: the same three sub-checks composed by the same intersection loop in the same order, abstaining on the same trichotomy (no sub-check produced a reading / zero survivors / more than one survivor), at the same FALLBACK_CONFIDENCE_SINGLE_EVIDENCE/MULTI_EVIDENCE constants — imported from local_fallback, not redeclared. It calls filter_by_border_color and match_artist directly, and duplicates find_symbol_matches' arithmetic against the same PROTECTED CORE SYMBOL_DISTANCE_THRESHOLD/SYMBOL_MARGIN.

Same underlying signal. Stage D reads persisted ImageEvidence rather than a fresh fetch, but every field it reads is Stage C's output of the same extractor:

sub-check	pilot (local-fallback-v1)	Stage D (stage-d-fallback-v1)
border	classify_border_color(live image)	evidence.layout_class — literally classify_border_color's stored output
artist	detect_illus_anchor → extract_artist_name	evidence.artist_ocr_name — extract_artist_name's stored output
symbol	find_symbol_matches scans SYMBOL_STRIP_BOX	evidence.symbol_phash — a hash of that same SYMBOL_STRIP_BOX region

Not an artefact. Neither function calls the other, and they are cast by two different management commands (local_identify_printing_tags vs local_calculate_verdicts). The agreement is the signature of one witness counted twice, exactly as the doctrine describes. Premise holds.

2. The entanglement trap — checked BEFORE removing anything

local-ocr-v1 could not simply be switched off because it shared a management command with local-phash-v1. The equivalent check here found the entanglement is worse in three independent ways, which is why this PR is a scalpel on one call site rather than a switch-off:

1. No --engine value exists for the fallback. The pilot command's choices are ocr/phash/both; the fallback rode along on whatever pass 1 selected. "Stop running the command" would have silently dropped both local-ocr-v1 and local-phash-v1.
2. local-fallback-v1 is also an attribute-chip identity. cast_border_attribute_vote, cast_frame_style_vote and cast_bleed_edge_vote cast CardTagVote rows under that same id. Stage D has no analogue for any of the three and none was part of the printing-vote measurement (which counted CardPrintingTag only). Retiring the identity would have dropped them; only its printing channel is retired here.
3. local_fallback.py has a caller outside the pilot. local_residual_classify.recover_frame_mismatch_printing_via_fallback_refetch still calls run_fallback_for_card for historical frame-mismatch recovery, and image_evidence.py still calls cast_border_attribute_vote. local_fallback.py therefore stays live and functionally unmodified (docstring only).

3. What changed

• run_pilot no longer calls run_fallback_for_card. The pass-2 write branch — positive vote, cluster propagation, the "eliminated" is_no_match vote, and the CardScanLog abstention rows — is removed, not gated off, along with the now-dead already_fallback_covered idempotence set, the fallback_* fields on CardOutcome, and the permanently-zero results["fallback"] entry (which would otherwise misreport a retired calculator as one that ran and found nothing).
• Retirement lock in flush() — the single point every printing vote this module casts passes through. It refuses any CardPrintingTag row whose calculator family is retired, so a future local-fallback-v2 cannot silently un-retire a ratified ruling. Keyed on family, never the literal string, and the family set is derived via models.calculator_family(FALLBACK_ANONYMOUS_ID) rather than written out a second time, so the two cannot drift. It deliberately does not screen tag_votes_batch, per trap Promote PringlePrints to a full ordering tab #2.
• Docstrings in local_fallback.py, the pilot module and the management command record the ruling and, explicitly, what survives it.

4. Vote rows are NOT purged

Existing local-fallback-v1 rows are left in place — history is kept, only future casting stops. Removing them is a separate, owner-authorized purge_machine_votes step and is deliberately not part of this PR. No mutating management command was run against prod as part of this change.

5. Verification

check	result
test_local_identify_printing_tags.py	226 passed
Full cardpicker/tests/ suite	2954 passed, 6 skipped (incl. 130 snapshots)
ruff / black / isort / mypy (pre-commit)	all passed
mypy on the changed module	2 errors, identical to the master baseline — no new errors
Mutation check on the retirement lock	disabling the raise makes test_the_flush_refuses_a_retired_family_row_by_family_not_by_literal fail — the test is not vacuous

Test classes whose subject no longer has a code path were replaced rather than deleted: TestFallbackPrintingVoteRetired asserts the retirement (including that a pass-1 miss never computes the verdict, so the run doesn't pay for an extra artist-crop OCR pass and symbol scan per missed card), and TestPass2Wiring now pins the two things that must survive it — the attribute-chip channel and the frame-mismatch consistency check.

Open items

1. Vote purge — whether and when to purge the 11,947 historical local-fallback-v1 printing rows. Owner-authorized ops step, not done here.
2. Cluster propagation of pre-existing rows — historical local-fallback-v1 votes propagated to absorbed cluster members remain; unaffected by this change, in scope for the purge decision above.

---

Prior salvaged WIP (wip/retire-local-fallback-salvage, 03ec8cc4) was adopted as the starting point rather than discarded — its analysis was independently re-derived and confirmed correct here. Two defects were fixed on top: the retirement-lock test never actually exercised the guard raising (it only asserted set membership, and would have passed with the guard deleted), and a stale fallback's "eliminated" comment remained in the management command's report path.

🤖 Generated with Claude Code

https://claude.ai/code/session_013NhYmT1PxCcyemA16dFDxN