docs(discovery): correct the model-picker contract

Author: adamtasteslikegood

specs/discovery/sprint10/product-grill-2026-09-06.md

@@ -20,7 +20,7 @@ python3 ~/.claude/plugins/cache/claude-code-skills/product-skills/2.11.1/skills/
 | Q4  | Prioritisation | **Sprint 10 is not the launch sprint.** Ordinal cost-of-delay buckets, not RICE (reach = 0 pre-launch). Rank: 1 KAN-268 · 2 instrumentation · 3 images/LCP · 4 nav · 5 mobile layout · 6 filter/sort · 7 Cloud Deploy preview URLs · 8 footer · 9 settings. Flips: filter/sort above layout if the primary S10 user is Adam's own Kitchen; images below nav if an interim resizing proxy lands the LCP number; Cloud Deploy to the top if it blocks the release.                                                    | Adam override on launch                                                                           |
 | Q5  | Workbench      | Two loops, no new environment. **Inner:** local `npm run dev` + gstack browse at 390×844 + local Lighthouse. **Outer:** per-PR preview URLs on staging via Cloud Run revision tags on the Cloud Deploy path (= the KAN-250/KAN-227 acceptance). **Cloud Workstations out.** Staging is complete by design: OAuth live with staging credentials, both Cloud Run services, Pub/Sub, dedicated Cloud SQL Postgres, Artifact Registry, image bucket; intentionally no Valkey and no Cloud NAT. KAN-234 closed as stale. | Confirmed with corrections                                                                        |
 | Q6  | Measurement    | **North Star: recipes kept per week** (any save into a Kitchen, any source, guest or signed-in). Inputs = the PRD's five KPIs: recipe-page reach · view→save · generation + image completion · returning Kitchen use · publication. Instrument with **Datadog RUM** (SPA + SSR, 100% sampling, custom actions) behind a **consent toggle** via `trackingConsent`, which makes the privacy policy's promised opt-out true. Web-vitals bands apply now; funnel bands after four weeks.                                | Confirmed                                                                                         |
-| Q7  | AI feature     | Settings tab at rank 9 (first cut): default servings, metric/imperial, image generation on/off, **model picker bound to GA models from `GET /api/models`** (no preview models, enforced in code). **Eval spec before UI:** 12-prompt golden set (4 cuisines × 3 difficulty) per model; schema-valid ≥ 98% first attempt or the model is dropped; p95 ≤ 20 s; error → fallback to default with a UI notice; pytest on fixtures in CI + manual live dispatch. PRD non-goal amended in this branch.                    | Confirmed; PRD is a rough draft (reverse-engineered, interrupted run), not a constraint, per Adam |
+| Q7  | AI feature     | Settings tab at rank 9 (first cut): default servings, metric/imperial, image generation on/off, **model picker bound to an explicit server-owned GA allowlist derived from `GET /api/models`**. The endpoint currently filters capabilities, not release channel, so KAN-269 must add the allowlist before the picker; preview, experimental, and moving `latest` aliases are excluded. **Eval spec before UI:** 12-prompt golden set (4 cuisines × 3 difficulty) per model; all 12 must be schema-valid on the first attempt or the model is dropped; p95 ≤ 20 s; error → fallback to default with a UI notice; endpoint-allowlist and fixture tests in CI + manual live dispatch. PRD non-goal amended in this branch.                    | Confirmed; PRD is a rough draft (reverse-engineered, interrupted run), not a constraint, per Adam |
 
 ## Evidence baseline (all reproducible)