Backend PR #562 retains Gemini OCR and fixes French One Piece code-family filtering. The matcher keeps OCR language through every fallback and ranks all variants independently of the capped title vocabulary. Ambiguous artworks, localized versions and DON prints require confirmation. Unavailable or unreadable OCR cannot silently certify a visual fallback.

The API admits at most two active scans and eight FIFO waiters before multipart parsing and quota charging. Maximum queue wait is 2.5 seconds. A local 50-request burst processed ten scans with Gemini and refused 40 before inference with a retryable 503. This bounds resource use; it does not guarantee all 50 simultaneous scans finish. Queued disconnects, deadlines and handler failures recover slots.

Local validation after integrating current staging: API 1,538 passed / 17 skipped; ingest 554 passed; TypeScript/JavaScript checking and frozen policy fixtures passed. A local HTTP/PGlite/pgvector harness selects 24 expected fixture identities using synthetic vectors and recorded OCR, including FR and parallel cases. This is not a real-photo accuracy measurement. Full local Docker E2E is blocked by the unavailable Docker Desktop engine; the legacy Tesseract runtime download also returns 404. No thresholds were weakened and no production dependencies, database migrations, OCR model changes or native contract changes are introduced. No mobile rebuild is required for this backend change.

Delivery: PR #562 merged into staging at 446a411fa62d443647992d6c365fea7999e836f9. The user explicitly authorized proceeding without GitHub Actions, whose jobs could not start because of account payments/spending limits. CI is not reported green. The previously blocked merge was subsequently permitted and completed under that clarified authorization.

Deployed on 22 October at 22:41 Europe/Paris as skns-api:gemini-scan-446a411-pinned-20261022. The image reuses the exact previous production base and dependencies (Node 22.23.2); a clean build's unintended Node patch update was caught before promotion. Only the compiled index/admission and scan matching/decision modules changed. No database migration or embedding regeneration was run.

The candidate had one CPU, 768 MiB RAM, read-only data mounts and enforced read-only PostgreSQL connections. Nine sequential release cases covered FR and parallel OP, Event/Stage, Pokémon/Classic, a conflicting mobile number and an OCR busy replay; three extracted identity through Gemini, the others reused recorded identity. One strict runtime-comparison failure triggered an automatic rollback; the final promotion verified unchanged environment, runtime settings, data mounts and other services. A concurrent pricing prefill job was preserved. The temporary candidate and build helper were removed.

Post-promotion read-only checks used fresh Gemini requests and real embeddings: Shanks OP09-001 selected fr-OP09-001; Noeunoeuf 001/128 selected 30th-001, both identified in about 1.7 seconds server-side. Public health/readiness and catalogue endpoints passed. These reference checks do not certify all phone photos or 50-client real throughput. The candidate's anniversary Pikachu collector misread remained uncertain; near-identical promos also remain uncertain rather than being silently certified. No mobile build is required.

The API dependency audit found no high/critical advisories and two existing low/moderate advisories; this is not a global security certification. Local Docker E2E remains unvalidated for the infrastructure reasons above.