Immutable public build configuration

Anonymous deployments return engine IDs from GET /api/v1/godot-versions. GET /api/v1/catalog/{id} returns that engine's module list, typed option schema, and revision. Public responses omit repository locations. Authelia-enabled public submission requires godot_version_id and catalog_revision; the optional godot_ref must agree with the selected row.

Admission holds the catalog tables against administrative writes while checking the revision and recording jobs.catalog_snapshot in the quota transaction. The snapshot includes the effective engine repository/ref, module releases, dependencies, destinations, and option definitions. An explicit fork repository never inherits the global repository, even when both use the same ref.

Preparation uses the saved snapshot and shares mirror locks with other builds. Later catalog edits cannot change an admitted selection. A stale new submission returns 409 and the form reloads its catalog for review. An already accepted idempotent retry returns its original job even if the catalog was edited or removed. Historical specs remain unchanged and have no invented snapshots.

Public options include optimization, LTO, debug symbols, 3D, Vulkan/OpenGL, and Default/Enabled/Disabled controls for GDScript, regex, and ZIP modules. The API normalizes options from one backend schema, persists them in the spec, and uses them for argument generation. It rejects unknown keys, wrong types, raw SCons arguments, module ref overrides, disabled dependency destinations, editors without 3D, and configurations with no supported renderer. Local CLI expert arguments remain available separately.

The schema follows Godot's 4.3 and 4.4 build options. Metal, Direct3D, ThinLTO, and additional built-in toggles are not currently published by this service's schema. Administrator-published forks must support the advertised options.

Verification includes real PostgreSQL snapshot/replay tests, a local Git fixture with different upstream/fork contents at the same tag, strict option and expanded dependency checks, and frontend fork/option tests. Real Godot compilation remains an acceptance requirement. Migration 0009_source_pins.sql records exact engine and selected-module commits before compilation. Existing queue retries reuse those commits; expired owners cannot replace them. Durable execution phase advancement also requires committed pins. Digest-pinned production toolchain manifests and the controller/phase-service wiring remain unfinished.