Remove legacy Tier mutation routes

Author: deltawi

docs/admin-ui/tiers.md

@@ -111,9 +111,9 @@ Creation behavior follows the effective runtime mode:
 
 Use a custom tier or clone an existing tier when one customer needs different model access, model limits, pricing, or capacity. Do not recreate that policy with organization fields. While an active tier is authoritative in `enforce`, the API rejects new organization-level per-model limit maps and organization Asset Access writes; organization-wide RPM/TPM/RPH/RPD/TPD hard caps remain editable.
 
-If an organization already had legacy per-model RPM/TPM maps before its tier was assigned, its Service Policy card shows a warning because those safety caps still apply alongside the tier. First reproduce any required limits on the tier, publish and preview them, then use **Clear legacy model caps**. The confirmation warns that clearing them before the tier is ready can increase allowed traffic.
+If an organization already had legacy per-model RPM/TPM maps before its tier was assigned, its Service Policy card shows a warning because those safety caps still apply alongside the tier. First reproduce any required limits on the tier, preview and activate them, then use **Clear legacy model caps**. The confirmation warns that clearing them before the tier is ready can increase allowed traffic.
 
-`shadow` evaluates the staged tier but does not enforce it. For a newly created tier-first organization, DeltaLLM atomically snapshots the selected active version's allowed callable targets into legacy Asset Access so requests continue to work. That legacy mirror remains editable and authoritative during rollout; it intentionally does not follow later tier publications, allowing the preview and mismatch telemetry to expose policy changes before enforcement. Creating a new legacy organization through the API in this mode requires `"legacy_policy_exception": true`, matching the explicit migration checkbox in the drawer. `disabled` also keeps legacy Asset Access authoritative even if an assignment has already been staged. Once mode is `enforce`, the tier becomes authoritative and the organization Asset Access editor is hidden.
+`shadow` evaluates the staged tier but does not enforce it. For a newly created tier-first organization, DeltaLLM atomically snapshots the selected active version's allowed callable targets into legacy Asset Access so requests continue to work. That legacy mirror remains editable and authoritative during rollout; it intentionally does not follow later tier activations, allowing the preview and mismatch telemetry to expose policy changes before enforcement. Creating a new legacy organization through the API in this mode requires `"legacy_policy_exception": true`, matching the explicit migration checkbox in the drawer. `disabled` also keeps legacy Asset Access authoritative even if an assignment has already been staged. Once mode is `enforce`, the tier becomes authoritative and the organization Asset Access editor is hidden.
 
 The optional organization RPM, TPM, RPH, RPD, and TPD fields are global hard caps. They apply across all models, teams, and keys in addition to the tier's per-model controls. Leave them blank when no extra organization-wide ceiling is needed. Budgets, budget resets, and audit-content storage also remain organization settings.
 
@@ -232,9 +232,9 @@ Platform admins can inspect current pool utilization and temporarily boost one o
 | `POST` | `/ui/api/tier-capacity/boosts` | Apply a `1`-to-`100` weight multiplier with a Redis TTL of at most seven days |
 | `DELETE` | `/ui/api/tier-capacity/boosts` | Remove a temporary boost |
 
-Boost creation and deletion are written to the audit log and attributed to the affected organization. A boost is runtime state: it expires automatically and does not modify the published tier version. See the [Organization Tiers Rollout Runbook](../deployment/organization-tiers-rollout.md) for API examples, metrics, and troubleshooting.
+Boost creation and deletion are written to the audit log and attributed to the affected organization. A boost is runtime state: it expires automatically and does not modify the active tier version. See the [Organization Tiers Rollout Runbook](../deployment/organization-tiers-rollout.md) for API examples, metrics, and troubleshooting.
 
-The dashboard reports `live_data.status` as `healthy`, `partial`, or `unavailable`. When Redis cannot supply a live section, its numeric values are `null` and the UI shows an em dash; they are never presented as zero. The published pool configuration remains available from the tier snapshot.
+The dashboard reports `live_data.status` as `healthy`, `partial`, or `unavailable`. When Redis cannot supply a live section, its numeric values are `null` and the UI shows an em dash; they are never presented as zero. The active pool configuration remains available from the tier snapshot.
 
 ## Recommended User Journey
 
@@ -328,7 +328,7 @@ You want to sell a Growth plan:
 - `gpt-4o` uses `growth-premium-pool`
 - customer price is lower than pay-as-you-go
 
-Create one `Growth` tier, publish it, and assign it to every Growth customer.
+Create one `Growth` tier, activate it, and assign it to every Growth customer.
 
 When a customer upgrades to Enterprise, assign the Enterprise tier instead of manually changing model access, prices, and limits on that organization.
 

docs/api/admin.md

@@ -130,12 +130,17 @@ Tier administration requires platform-admin permission.
 |--------|----------|---------|
 | `GET`, `POST` | `/ui/api/tiers` | List or create tiers |
 | `GET`, `PATCH`, `DELETE` | `/ui/api/tiers/{tier_id}` | Read, update, or delete a tier |
-| `POST` | `/ui/api/tiers/{tier_id}/versions` | Create a draft version |
+| `POST` | `/ui/api/tiers/bootstrap` | Atomically create a tier and its first draft |
+| `GET`, `POST` | `/ui/api/tiers/{tier_id}/versions` | List versions or create a draft version |
 | `GET` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}` | Read a version and its policies |
 | `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/clone` | Clone a version into a draft |
-| `PUT` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/model-policies` | Replace the draft's model policies |
-| `PUT` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/capacity-pools` | Replace the draft's capacity pools |
-| `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/publish` | Publish a version |
+| `GET`, `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/model-policies` | List or create model policies |
+| `PATCH`, `DELETE` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/model-policies/{policy_id}` | Update or delete a model policy |
+| `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/model-policies/bulk-limits` | Update request limits in bulk |
+| `GET`, `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/capacity-pools` | List or create capacity pools |
+| `PATCH`, `DELETE` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/capacity-pools/{pool_id}` | Update or delete a capacity pool |
+| `GET` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/activation-preview` | Preview activation impact and concurrency guards |
+| `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/activate` | Activate a draft using revision and active-version guards |
 | `POST` | `/ui/api/tiers/{tier_id}/versions/{tier_version_id}/archive` | Archive a version |
 | `GET`, `POST` | `/ui/api/organizations/{organization_id}/tier-assignments` | List or create assignments |
 | `PATCH`, `DELETE` | `/ui/api/organizations/{organization_id}/tier-assignments/{assignment_id}` | Update or remove an assignment |

plans/tiers-ux-redesign-remediation-plan.md

@@ -1,6 +1,8 @@
 # Tiers UX redesign: code-review remediation plan v2
 
 > Status: core implementation complete in the isolated `feature/tiers-ux-redesign` worktree; release-targeted verification is in progress. This revision incorporates both code-review rounds, resolves the five follow-up findings, and supersedes conflicting decisions in `tiers-ux-redesign-mapping.md` and earlier revisions of this document.
+>
+> Removal decision (2026-08-16): after the redesigned client and browser smoke test proved the guarded row-level workflow, immediate breaking removal was authorized. Any compatibility-stage instruction below is retained as historical rollout rationale but is superseded: collection replacement PUTs and bodyless `/publish` were deleted rather than gated.
 
 ## Implementation checkpoint
 
@@ -15,7 +17,7 @@ Completed in the current worktree:
 - bounded compatible-capacity-pool lookup for the model-policy editor;
 - backend repository/API coverage, UI helper coverage, and real PostgreSQL migration/catalog-query validation.
 
-The legacy replacement and bodyless publish routes remain compatibility-only during the additive rollout stage. Their GA `428` enforcement gate is intentionally not enabled until the redesigned client is deployed and staging telemetry proves there are no remaining legacy callers.
+The legacy replacement and bodyless publish routes, their request schemas, service/repository implementations, client methods, audit actions, and compatibility tests have been removed. Guarded row-level mutations and `/activate` are the only supported configuration and activation paths.
 
 ## 0. Follow-up review closure
 
@@ -120,7 +122,7 @@ Semantics:
 - A newly created blank version starts at revision `0`.
 - A cloned/restored version also starts at revision `0`; its copied contents are its initial configuration.
 - Each successful policy/pool create, update, delete, or bulk mutation increments revision exactly once.
-- Lifecycle-only changes such as publish/archive update `updated_at` but do not increment configuration revision.
+- Lifecycle-only changes such as activation/archive update `updated_at` but do not increment configuration revision.
 - `created_by_account_id` is populated for platform-session admins.
 - Master-key creation records `created_by_kind='master_key'` with no account ID.
 - Existing rows are backfilled as `created_by_kind='unknown'`; do not infer a creator from the publisher.
@@ -634,7 +636,7 @@ On `tier_configuration_stale`:
 | Two admins save revision 4 | First succeeds with revision 5; second gets `409`, no row is overwritten |
 | Policy/pool ID belongs to another Tier or version | Scoped `404`; neither child row nor either version revision changes |
 | Policy is saved while its pool is concurrently removed | Version lock serializes operations; the later operation revalidates against current state |
-| Draft is published while an editor is open | Next edit gets non-draft conflict; UI refetches and becomes read-only |
+| Draft is activated while an editor is open | Next edit gets non-draft conflict; UI refetches and becomes read-only |
 | Bootstrap response is lost | Same idempotency key returns the original tier and Draft v1 |
 | Two requests simultaneously use the same principal/key | Second waits on the transaction advisory lock, then replays the first committed Tier/v1 |
 | Bootstrap key is reused for different form data | `409` with idempotency-conflict code; no mutation |

src/api/admin/endpoints/tier_schemas.py

@@ -48,10 +48,6 @@ class TierModelPolicyRequest(_StrictRequest):
     metadata: dict[str, Any] | None = None
 
 
-class TierModelPolicyReplaceRequest(_StrictRequest):
-    policies: list[TierModelPolicyRequest]
-
-
 class TierModelPolicyCreateRequest(TierModelPolicyRequest):
     expected_revision: int = Field(ge=0)
 
@@ -112,10 +108,6 @@ class TierCapacityPoolRequest(_StrictRequest):
     metadata: dict[str, Any] | None = None
 
 
-class TierCapacityPoolReplaceRequest(_StrictRequest):
-    pools: list[TierCapacityPoolRequest]
-
-
 class TierCapacityPoolCreateRequest(TierCapacityPoolRequest):
     expected_revision: int = Field(ge=0)
 

src/api/admin/endpoints/tiers.py

@@ -10,13 +10,11 @@
     TierActivationRequest,
     TierCapacityPoolCreateRequest,
     TierCapacityPoolPatchRequest,
-    TierCapacityPoolReplaceRequest,
     TierConfigurationMutationRequest,
     TierCreateRequest,
     TierModelPolicyCreateRequest,
     TierModelPolicyBulkLimitsRequest,
     TierModelPolicyPatchRequest,
-    TierModelPolicyReplaceRequest,
     TierPatchRequest,
     TierVersionCreateRequest,
 )
@@ -589,54 +587,6 @@ async def delete_tier_model_policy(
     return response
 
 
-@router.put(
-    "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/model-policies",
-    dependencies=_PLATFORM_ADMIN_DEPENDENCY,
-)
-async def replace_tier_model_policies(
-    request: Request,
-    tier_id: str,
-    tier_version_id: str,
-    payload: TierModelPolicyReplaceRequest,
-) -> dict[str, Any]:
-    request_start = perf_counter()
-    service = _tier_service(request)
-    request_payload = _payload(payload)
-    policies_payload = request_payload["policies"]
-    before_detail: dict[str, Any] | None = None
-    try:
-        before_detail = await service.get_tier_version_detail(tier_id, tier_version_id)
-        records = await service.replace_model_policies(
-            tier_id,
-            tier_version_id,
-            policies_payload,
-        )
-    except TierAdminError as exc:
-        raise _http_error(exc) from exc
-
-    response = {"data": [serialize_model_policy(record) for record in records]}
-    tier_policy_invalidation = await _reload_tier_policy_for_audit(request)
-    await emit_admin_mutation_audit(
-        request=request,
-        request_start=request_start,
-        action=AuditAction.ADMIN_TIER_MODEL_POLICIES_REPLACE,
-        resource_type="tier_model_policy_set",
-        resource_id=tier_version_id,
-        request_payload={
-            "tier_id": tier_id,
-            "policy_count": len(policies_payload),
-        },
-        response_payload={
-            "policy_count": len(response["data"]),
-            "tier_policy_invalidation": tier_policy_invalidation,
-        },
-        before={"policy_count": len(before_detail["model_policies"]) if before_detail else 0},
-        after={"policy_count": len(response["data"])},
-        metadata={"tier_policy_invalidation": tier_policy_invalidation},
-    )
-    return response
-
-
 @router.get(
     "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/capacity-pools",
     dependencies=_PLATFORM_ADMIN_DEPENDENCY,
@@ -813,51 +763,6 @@ async def delete_tier_capacity_pool(
     return response
 
 
-@router.put(
-    "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/capacity-pools",
-    dependencies=_PLATFORM_ADMIN_DEPENDENCY,
-)
-async def replace_tier_capacity_pools(
-    request: Request,
-    tier_id: str,
-    tier_version_id: str,
-    payload: TierCapacityPoolReplaceRequest,
-) -> dict[str, Any]:
-    request_start = perf_counter()
-    service = _tier_service(request)
-    request_payload = _payload(payload)
-    pools_payload = request_payload["pools"]
-    before_detail: dict[str, Any] | None = None
-    try:
-        before_detail = await service.get_tier_version_detail(tier_id, tier_version_id)
-        records = await service.replace_capacity_pools(
-            tier_id,
-            tier_version_id,
-            pools_payload,
-        )
-    except TierAdminError as exc:
-        raise _http_error(exc) from exc
-
-    response = {"data": [serialize_capacity_pool(record) for record in records]}
-    tier_policy_invalidation = await _reload_tier_policy_for_audit(request)
-    await emit_admin_mutation_audit(
-        request=request,
-        request_start=request_start,
-        action=AuditAction.ADMIN_TIER_CAPACITY_POOLS_REPLACE,
-        resource_type="tier_capacity_pool_set",
-        resource_id=tier_version_id,
-        request_payload={"tier_id": tier_id, "pool_count": len(pools_payload)},
-        response_payload={
-            "pool_count": len(response["data"]),
-            "tier_policy_invalidation": tier_policy_invalidation,
-        },
-        before={"pool_count": len(before_detail["capacity_pools"]) if before_detail else 0},
-        after={"pool_count": len(response["data"])},
-        metadata={"tier_policy_invalidation": tier_policy_invalidation},
-    )
-    return response
-
-
 @router.get(
     "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/activation-preview",
     dependencies=_PLATFORM_ADMIN_DEPENDENCY,
@@ -920,46 +825,6 @@ async def activate_tier_version(
     return response
 
 
-@router.post(
-    "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/publish",
-    dependencies=_PLATFORM_ADMIN_DEPENDENCY,
-)
-async def publish_tier_version(
-    request: Request,
-    tier_id: str,
-    tier_version_id: str,
-) -> dict[str, Any]:
-    request_start = perf_counter()
-    service = _tier_service(request)
-    try:
-        before = serialize_tier_version(
-            await service.require_version_for_tier(tier_id, tier_version_id)
-        )
-        published = await service.publish_tier_version(
-            tier_id,
-            tier_version_id,
-            published_by_account_id=_actor_account_id(request),
-        )
-    except TierAdminError as exc:
-        raise _http_error(exc) from exc
-
-    response = serialize_tier_version(published)
-    tier_policy_invalidation = await _reload_tier_policy_for_audit(request)
-    await emit_admin_mutation_audit(
-        request=request,
-        request_start=request_start,
-        action=AuditAction.ADMIN_TIER_VERSION_PUBLISH,
-        resource_type="tier_version",
-        resource_id=tier_version_id,
-        request_payload={"tier_id": tier_id},
-        response_payload={**response, "tier_policy_invalidation": tier_policy_invalidation},
-        before=before,
-        after=response,
-        metadata={"tier_policy_invalidation": tier_policy_invalidation},
-    )
-    return response
-
-
 @router.post(
     "/ui/api/tiers/{tier_id}/versions/{tier_version_id}/archive",
     dependencies=_PLATFORM_ADMIN_DEPENDENCY,

src/audit/actions.py

@@ -91,15 +91,13 @@ class AuditAction(str, Enum):
     ADMIN_TEAM_MEMBER_ADD = "ADMIN_TEAM_MEMBER_ADD"
     ADMIN_TEAM_MEMBER_REMOVE = "ADMIN_TEAM_MEMBER_REMOVE"
     ADMIN_TEAM_UPDATE = "ADMIN_TEAM_UPDATE"
-    ADMIN_TIER_CAPACITY_POOLS_REPLACE = "ADMIN_TIER_CAPACITY_POOLS_REPLACE"
     ADMIN_TIER_CAPACITY_POOL_CREATE = "ADMIN_TIER_CAPACITY_POOL_CREATE"
     ADMIN_TIER_CAPACITY_POOL_DELETE = "ADMIN_TIER_CAPACITY_POOL_DELETE"
     ADMIN_TIER_CAPACITY_POOL_UPDATE = "ADMIN_TIER_CAPACITY_POOL_UPDATE"
     ADMIN_TIER_CAPACITY_BOOST_DELETE = "ADMIN_TIER_CAPACITY_BOOST_DELETE"
     ADMIN_TIER_CAPACITY_BOOST_UPSERT = "ADMIN_TIER_CAPACITY_BOOST_UPSERT"
     ADMIN_TIER_CREATE = "ADMIN_TIER_CREATE"
     ADMIN_TIER_DELETE = "ADMIN_TIER_DELETE"
-    ADMIN_TIER_MODEL_POLICIES_REPLACE = "ADMIN_TIER_MODEL_POLICIES_REPLACE"
     ADMIN_TIER_MODEL_POLICY_CREATE = "ADMIN_TIER_MODEL_POLICY_CREATE"
     ADMIN_TIER_MODEL_POLICY_BULK_LIMITS = "ADMIN_TIER_MODEL_POLICY_BULK_LIMITS"
     ADMIN_TIER_MODEL_POLICY_DELETE = "ADMIN_TIER_MODEL_POLICY_DELETE"
@@ -109,7 +107,6 @@ class AuditAction(str, Enum):
     ADMIN_TIER_VERSION_ACTIVATE = "ADMIN_TIER_VERSION_ACTIVATE"
     ADMIN_TIER_VERSION_CLONE = "ADMIN_TIER_VERSION_CLONE"
     ADMIN_TIER_VERSION_CREATE = "ADMIN_TIER_VERSION_CREATE"
-    ADMIN_TIER_VERSION_PUBLISH = "ADMIN_TIER_VERSION_PUBLISH"
     ADMIN_USER_BLOCK = "ADMIN_USER_BLOCK"
     ADMIN_USER_CREATE = "ADMIN_USER_CREATE"
     ADMIN_USER_DELETE = "ADMIN_USER_DELETE"