feat(api,extension): video-first mediaState, orchestrator race guard, provenance from snapshot

Align all platform adapters to give has_video precedence over has_images,
matching the SPEC: any detected video/iframe causes the post to be skipped
even when images are present. LessWrong, X, and Substack adapters were
previously images-first and are now corrected.

Other changes:
- Orchestrator: atomic updateMany guard prevents processing an investigation
  that reached a terminal state between lease claim and start
- Post router: derive provenance from InvestigationInput snapshot for all
  statuses, not just COMPLETE
- parseProgressClaims: fail-fast on malformed data instead of silent fallback
- page-content-decision: only auto-investigate for NOT_INVESTIGATED; interim
  snapshots are display data
- CI: add .github/actions/** to path filters, drop Firefox XPI artifact
- README: add Wikipedia to supported platforms table

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hugbubby

.github/workflows/deploy.yml

@@ -136,6 +136,7 @@ jobs:
               - 'src/typescript/pnpm-workspace.yaml'
               - 'src/typescript/api/Dockerfile'
               - '.github/workflows/deploy.yml'
+              - '.github/actions/**'
 
   decide-deploy:
     needs: [resolve-target, detect-changes]

.github/workflows/pr-checks.yml

@@ -33,6 +33,7 @@ jobs:
               - 'src/typescript/**'
               - 'src/helm/openerrata/**'
               - '.github/workflows/**'
+              - '.github/actions/**'
 
       - name: Check for promote PR
         id: gate

.github/workflows/release-extension.yml

@@ -90,10 +90,9 @@ jobs:
           chrome_zip="$GITHUB_WORKSPACE/openerrata-extension-chrome-${{ steps.version.outputs.version }}.zip"
           chrome_crx="$GITHUB_WORKSPACE/openerrata-extension-chrome-${{ steps.version.outputs.version }}.crx"
           firefox_zip="$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip"
-          firefox_xpi="$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.xpi"
           limit_bytes=5242880
 
-          for artifact in "$chrome_zip" "$chrome_crx" "$firefox_zip" "$firefox_xpi"; do
+          for artifact in "$chrome_zip" "$chrome_crx" "$firefox_zip"; do
             bytes="$(stat -c%s "$artifact")"
             if [ "$bytes" -gt "$limit_bytes" ]; then
               echo "$(basename "$artifact") exceeds 5 MiB: ${bytes} bytes"
@@ -104,7 +103,6 @@ jobs:
       - name: Verify Firefox package integrity
         run: |
           unzip -t "$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip"
-          unzip -t "$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.xpi"
 
       - name: Lint Firefox extension package
         run: npx -y web-ext@8.9.0 lint --source-dir extension/dist/firefox
@@ -117,7 +115,6 @@ jobs:
             ${{ github.workspace }}/openerrata-extension-chrome-${{ steps.version.outputs.version }}.zip
             ${{ github.workspace }}/openerrata-extension-chrome-${{ steps.version.outputs.version }}.crx
             ${{ github.workspace }}/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip
-            ${{ github.workspace }}/openerrata-extension-firefox-${{ steps.version.outputs.version }}.xpi
 
   release:
     needs: [build-and-test]
@@ -140,7 +137,6 @@ jobs:
             openerrata-extension-chrome-${{ needs.build-and-test.outputs.version }}.zip
             openerrata-extension-chrome-${{ needs.build-and-test.outputs.version }}.crx
             openerrata-extension-firefox-${{ needs.build-and-test.outputs.version }}.zip
-            openerrata-extension-firefox-${{ needs.build-and-test.outputs.version }}.xpi
           generate_release_notes: true
 
   publish:

README.md

@@ -61,6 +61,7 @@ page and change the API URL.
 | LessWrong | URL match (`lesswrong.com`) |
 | X (Twitter) | URL match (`x.com`, `twitter.com`) |
 | Substack | URL match (`*.substack.com/p/*`) + DOM fingerprint for custom domains |
+| Wikipedia | URL match (`*.wikipedia.org/wiki/*`, `*.wikipedia.org/w/index.php*`) |
 
 ## Public API
 

SPEC.md

@@ -61,7 +61,8 @@ misleading.
 
 v1 ships fact-checking for posts on LessWrong, X, Substack, and Wikipedia.
 Investigations use post text plus attached images when available. Posts classified
-as `has_video` (video/iframe detected and no extracted images) are skipped.
+as `has_video` (any detected video/iframe embed) are skipped, even when text and
+images are also present.
 
 Users can trigger investigations in two ways (both async queued):
 
@@ -181,7 +182,7 @@ Four key design decisions:
 4. **Investigations are multimodal for images.** When image attachments are
    available, we include image URLs in the model input (`input_image`)
    alongside text. Video is not analyzed in v1; posts classified as
-   `has_video` (video/iframe detected and no extracted images) are visibly
+   `has_video` (any detected video/iframe embed) are visibly
    skipped.
 5. **Edited posts use incremental updates.** If a post is edited and a prior
    complete `SERVER_VERIFIED` investigation exists, we run an "update investigation"
@@ -279,9 +280,8 @@ The prompt principles (exact wording TBD):
   system and will be selectively highlighted.
 - **Claims must remain text-grounded.** Even when images are provided to the investigator, flagged
   claims must still be exact verbatim quotes from the post text so DOM matching remains reliable.
-- **Video is non-analyzable in v1.** Posts classified as `has_video` (video/iframe detected and no
-  extracted images) are skipped even when text is present. When extracted images are present, the
-  post is investigated using text + images, and video remains unanalyzed.
+- **Video is non-analyzable in v1.** Posts classified as `has_video` (any detected video/iframe
+  embed) are skipped even when text is present and even when extracted images are present.
 
 ## 2.5 User Interface
 
@@ -1606,7 +1606,7 @@ interface PlatformContent {
   externalId: string;
   url: string;
   contentText: string; // Client-observed normalized plain text; must be non-empty
-  mediaState: "text_only" | "has_images" | "has_video"; // "has_video" means video/iframe detected and imageUrls is empty; text may still be present.
+  mediaState: "text_only" | "has_images" | "has_video"; // Precedence: "has_video" if any video/iframe is detected; otherwise "has_images" when imageUrls is non-empty; otherwise "text_only".
   imageUrls: string[];
   imageOccurrences?: ImageOccurrence[]; // Positional image data; sent to API as observedImageOccurrences
   metadata: Record<string, unknown>;
@@ -1653,9 +1653,9 @@ DOM manipulation is reliable.
 5. Extract image URLs (`<img src>`), filter malformed/data URLs, and compute `mediaState`.
 6. Send `{ platform: "LESSWRONG", externalId, url, metadata.htmlContent, observedImageUrls? }` to background worker.
 
-**Media behavior:** Posts with images are investigated. Posts detected as private/gated are
-skipped (`reason: "private_or_gated"`). Among public posts, only `has_video` posts
-(video/iframe without images, even when text is present) are skipped.
+**Media behavior:** Posts with images and no video are investigated. Posts detected as private/gated
+are skipped (`reason: "private_or_gated"`). Among public posts, any `has_video` post
+(video/iframe detected, even when images and/or text are present) is skipped.
 
 **React reconciliation:** LessWrong uses React 16+. Use `MutationObserver` to detect re-renders and
 re-apply annotations. Store annotations in extension state, not DOM.
@@ -1669,9 +1669,9 @@ X uses a React SPA with aggressive DOM recycling.
 3. Target `[data-testid="tweetText"]`. Acknowledge this selector is fragile and may need
    maintenance.
 
-**Media behavior:** Extract image URLs separately from video detection. Investigate image posts.
-Skip private/protected tweets (`reason: "private_or_gated"`). Among accessible tweets, skip
-only `has_video` tweets (video present, no extracted images, even when tweet text exists).
+**Media behavior:** Extract image URLs separately from video detection. Investigate image-only
+tweets. Skip private/protected tweets (`reason: "private_or_gated"`). Among accessible tweets, skip
+any `has_video` tweet (video present, even when extracted images and/or tweet text exist).
 
 ## 3.11 Substack Content Script
 
@@ -1712,7 +1712,7 @@ JavaScript globals (`mw.config`).
 6. Wikipedia articles have no single author; no `Author` row is linked.
 
 **Media behavior:** Same rules as other platforms — extract image URLs and
-occurrences from the article body; `has_video` articles are skipped.
+occurrences from the article body; any `has_video` article is skipped.
 
 ## 3.13 Extension Manifest (v3)
 

src/typescript/api/prisma/migrations/0022_breaking_release_schema_tightening/migration.sql

@@ -2,7 +2,8 @@
 --
 -- 1. Drop unused PostVersionViewCredit table.
 -- 2. Convert InvestigationInput.provenance and .markdownSource from TEXT to Prisma enums.
--- 3. Add missing HTML blob presence CHECK constraints on SubstackVersionMeta and WikipediaVersionMeta.
+-- 3. Document why HTML blob presence CHECK constraints are intentionally not added for
+--    SubstackVersionMeta and WikipediaVersionMeta.
 
 -- ── 1. Drop PostVersionViewCredit ───────────────────────────────────────────
 

src/typescript/api/src/lib/services/orchestrator.ts

@@ -268,10 +268,19 @@ export async function orchestrateInvestigation(
   // When re-claiming a PROCESSING investigation with an expired lease
   // (stale worker takeover), the dead worker's progressClaims would
   // otherwise persist and be visible to clients until overwritten.
-  await prisma.investigation.update({
-    where: { id: investigation.id },
+  const transitionedToProcessing = await prisma.investigation.updateMany({
+    where: {
+      id: investigation.id,
+      OR: [{ status: "PENDING" }, { status: "PROCESSING" }],
+    },
     data: { status: "PROCESSING", progressClaims: CLEARED_PROGRESS_CLAIMS },
   });
+  if (transitionedToProcessing.count === 0) {
+    logger.info(
+      `Investigation ${investigation.id} moved to terminal state before processing began; skipping`,
+    );
+    return;
+  }
 
   const heartbeat = startRunHeartbeat(run.id, options.workerIdentity, logger);
 

src/typescript/api/src/lib/trpc/routes/post.ts

@@ -335,40 +335,41 @@ export const postRouter = router({
           },
         });
 
-        switch (investigation.status) {
-          case "COMPLETE": {
-            const completed = await loadInvestigationWithClaims(
-              prismaInvestigationRepository(ctx.prisma),
-              investigation.id,
-            );
-            if (!completed) {
-              throw new TRPCError({
-                code: "INTERNAL_SERVER_ERROR",
-                message: `Investigation ${investigation.id} disappeared after completion lookup`,
-              });
-            }
+        const loadedInvestigation = await loadInvestigationWithClaims(
+          prismaInvestigationRepository(ctx.prisma),
+          investigation.id,
+        );
+        if (!loadedInvestigation) {
+          throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: `Investigation ${investigation.id} disappeared after ensureInvestigationsWithUpdateMetadata`,
+          });
+        }
+
+        const provenance = parseProvenance({
+          investigationId: loadedInvestigation.id,
+          snapshot: loadedInvestigation.input,
+        });
 
+        switch (loadedInvestigation.status) {
+          case "COMPLETE": {
             return {
-              investigationId: completed.id,
-              status: completed.status,
-              provenance: parseProvenance({
-                investigationId: completed.id,
-                snapshot: completed.input,
-              }),
-              claims: formatClaims(completed.claims),
+              investigationId: loadedInvestigation.id,
+              status: loadedInvestigation.status,
+              provenance,
+              claims: formatClaims(loadedInvestigation.claims),
             };
           }
           case "PENDING":
           case "PROCESSING":
           case "FAILED":
             return {
-              investigationId: investigation.id,
-              status: investigation.status,
-              provenance:
-                postVersion.serverVerifiedAt !== null ? "SERVER_VERIFIED" : "CLIENT_FALLBACK",
+              investigationId: loadedInvestigation.id,
+              status: loadedInvestigation.status,
+              provenance,
             };
           default:
-            return unreachableInvestigationStatus(investigation.status);
+            return unreachableInvestigationStatus(loadedInvestigation.status);
         }
       } catch (error) {
         if (error instanceof InvestigationWordLimitError) {

src/typescript/api/src/lib/trpc/routes/post/investigation-queries.ts

@@ -269,13 +269,10 @@ export function parseProgressClaims(raw: unknown): {
   }
   const result = progressClaimsDbSchema.safeParse(raw);
   if (!result.success) {
-    console.warn(
-      "progressClaims failed schema validation:",
-      result.error.message,
-      "raw:",
-      JSON.stringify(raw).slice(0, 200),
-    );
-    return { pendingClaims: [], confirmedClaims: [] };
+    throw new TRPCError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: `progressClaims failed schema validation: ${result.error.message}`,
+    });
   }
   return { pendingClaims: result.data.pending, confirmedClaims: result.data.confirmed };
 }

src/typescript/api/test/unit/post-investigation-queries.test.ts

@@ -8,6 +8,7 @@ import {
   investigationQueriesInternals,
   loadInvestigationWithClaims,
   maybeRecordCorroboration,
+  parseProgressClaims,
   requireCompleteCheckedAtIso,
   selectSourceInvestigationForUpdate,
   toPriorInvestigationResult,
@@ -139,6 +140,13 @@ test("unreachableInvestigationStatus throws explicit internal error", () => {
   );
 });
 
+test("parseProgressClaims fails fast on malformed progress payload", () => {
+  assert.throws(
+    () => parseProgressClaims({ pending: ["bad"], confirmed: [] }),
+    /progressClaims failed schema validation/,
+  );
+});
+
 test("load and lookup helpers delegate to repository methods", async () => {
   const repo = nullRepo();
   assert.equal(await loadInvestigationWithClaims(repo, "inv-1"), null);