The main video-generation service builds each run from a reference video — a "swipe link" that supplies structure: cut positions, shot length, motion arcs, pacing. That reference was also, by accident, supplying the brand's voice, because nothing else in the pipeline had ever been asked to. Every generation re-derived what the brand sounded like from whatever video happened to be swiped that day. A VE lead's ask made the gap explicit: recreate a brand's style once, and stop re-feeding a swipe link that voice on every single run.
A reference video should supply a shot's grammar, never its subject. The same split that keeps a reference from dictating who's on screen should keep it from dictating what the brand sounds like.
Splitting structure from voice
PR #385 draws the line explicitly: the swipe link keeps supplying structure — that's the design, unchanged — but voice now comes from a separate, persistent brand profile. The implementation deliberately copies the shape of an existing, already-trusted store rather than inventing a new pattern: lib/catalog/profile-store.ts is structurally the same as product-store.ts — zod-validated, slug-keyed, mirrored to Drive, and critically, a no-op when unconfigured. An unreachable Drive degrades the planner back to today's behavior instead of failing a paid run outright. The profile's fields are field-for-field the same shape as the reference tool's own Research Profile — territory, angles, big ideas, claims — which means a brand's identity now has exactly one home instead of being re-inferred from whatever video got swiped last.
A write loop with no caller
PR #385 shipped appendProfileRun with zero callers — and PR #403 is the PR that noticed, and it's worth pausing on because the fix that would have been fastest was also wrong. The obvious move is calling it at the end of the render stitch. The store's own schema comment already explained why that's a trap: every field in a profile's run history is supposed to be copied from an external script, measure-pair.mjs, never recomputed inside the app. That script runs outside the pipeline, measures the finished master against the reference through one consistent instrument, and is what an editor actually reads when judging a run. An in-app recompute would produce a second set of numbers for the same render — and then a brand's permanent history and the editor's report could disagree about what happened to the same video. Two truths for one event is exactly the failure mode the store was written to avoid.
So the fix isn't a function call, it's a dedicated route: the external measurement script pushes, POST /api/profiles/<slug>/runs receives. One writer, one truth. And a route earns its keep over a thin forwarder in four concrete ways: it validates at the boundary with its own wire-contract schema — deliberately separate from the store's persistence-contract schema, because a malformed number reaching a brand's permanent history is exactly the failure a forwarder wouldn't catch; it bounds the inputs, refusing a 140% silence share or a fractional cut count on sight; and it distinguishes a 404 (no such profile) from a 502 (the write itself failed) rather than collapsing both into one generic error a caller can't act on differently.
An avatar client shipped with no flag, on purpose
PR #393 solves a different but related identity problem: a talking-head avatar generated scene by scene from an anchor description reproduces a slightly different person each time — eleven independently generated frames from one text description became eleven slightly different men, flagged by viewers as wrong-avatar or inconsistency at four separate timestamps in one render. The fix routes around the problem instead of tuning it: a client for a vendor model that generates the picture from the audio, so identity comes from one anchor image reused across the run rather than from a text description regenerated per scene.
It's also strictly better on cost and quality, which is part of why the PR justifies not shipping a flag at all:
| Path | Rate | 66s of talking track |
|---|---|---|
| Existing approach, as billed | $0.14/s | $9.24 (measured) |
| Avatar client, standard tier | $0.0562/s | $3.71 |
| Avatar client, pro tier | $0.115/s | $7.59 |
Cheaper, independently benchmarked ahead of a well-known competing avatar product, and built from an audio input the pipeline already produces — nothing discarded, warped, or repainted, which matters because an earlier avatar-adjacent approach had already been rejected for doing exactly that. The decision to ship without a feature flag is the interesting part: this isn't an alternative sitting beside the old path for an operator to toggle between. It's the documented, sanctioned successor to an approach the team had already marked do-not-retry. A flag implies a live choice between two still-valid options. Here there wasn't one — keeping a flag around would have preserved a decision that had already been made, dressed up as still being open.
What a paid render found that reasoning didn't
PR #409 is the sharpest bug in this cluster, and it's explicitly framed as a design error rather than a vendor failure. A render launched from an earlier PR generated a genuinely good avatar take — succeeded, billed $3.62 — and the pipeline's own downstream check threw it away and fell back to fully generative rendering for every beat instead, silently, with no error surfaced anywhere that would tell an operator this had happened.
The root cause was a rule that made sense in one context and stopped making sense in another: an all-or-nothing "every cut must land in detected silence" check, fine for a two-to-four shot bundle, and near-unreachable for a fifteen-beat ad that needs fourteen interior cuts when a natural spoken read offers roughly eight detectable silent pauses total. The check wasn't broken — it was correctly enforcing a rule that had quietly stopped fitting the size of ad it was being asked to gate. The fix doesn't loosen the rule; it changes what a "safe cut point" means. The one-call voiceover synthesis step already computes word-level alignment and had been discarding it. Persisting that alignment means a cut can land in the gap between two words — which is, by definition, never mid-word — instead of only in a detected silence, and the same fifteen-cut plan that used to fail categorically now lands cleanly.
Closing a session honestly
Two documentation PRs bookend this cluster and are worth citing on their own. PR #405 recalibrated an audio-feel check against real measured numbers and found all three of its firing rules had been unfireable since the check was written — one rule's absolute floor was strict enough to condemn the reference video itself, meaning a check that had been wired into the pipeline the entire time had never once been able to say anything. The same PR caught its own earlier mistake: an asset recommendation that would have fixed one defect (a missing product logo) by introducing a different one (a version of the asset without a required brand mark) — trading one visible error for a less visible one and calling it solved.
PR #427 closes the broader session with a document explicitly built to stop a future reader from re-deriving conclusions that had already been disproven with real measurements — five of them, listed by name, each one something a fresh reader would plausibly reach independently and each one wrong. That kind of handoff only works because it's honest about the false starts inside the same effort, not just the parts that landed.
The pattern: one write path, one source of truth
Every fix in this cluster is a variant of the same idea applied to a different kind of identity — voice, avatar, or the honesty of the record describing what a session actually found. A brand's voice needed exactly one home instead of an incidental one. A write function needed exactly one caller, reached through a route built for the purpose rather than bolted onto the nearest convenient step. An avatar model needed exactly one anchor image instead of a description regenerated per scene. None of these are hard engineering problems. They're all the same discipline, applied consistently: decide where a fact about identity lives, then make sure nothing else in the system is quietly allowed to supply a second answer.
