promptVersionId.corpusVersionId.config/liveconfig/live. Two gates must hold.config/live (a runtime-config flip, app-cached, no deploy). One live pair at a time; supersede-prior; full audit trail.promptVersionId and corpusVersionId, and a lock is compatibility-guarded: lock only if the prompt's required fields ⊆ the corpus's retrievalInterface.config/live as the locked baseline, so anything tuned on the Bench is what ships.