Live's AI grants move to the new default at boot (follows d072928): CHANGED_DEFAULT_NAMESPACES moves Live's ai.run.create and ai.run.read rows for openvibe.ai from [live.*, network.site_copy] to [live.*, network.site_copy, media.analyze] when they are still exactly the old default (an edited row is left alone). A new default alone never reached the existing rows (seeded with INSERT OR IGNORE), so production kept refusing media.analyze. test/principals.test.js seeds the old default, boots again and checks Live's AI token.

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 405a6dea..5e0950c5 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -221,6 +221,9 @@ const CHANGED_DEFAULT_NAMESPACES = [
      // Tools' job results under each developer project's child namespace (WS-L task 5, Media namespaces WS-G task 2).
      ['tools', 'media.object.upload', 'openvibe.media', ['tools'], ['tools', 'tools.*']],
      ['tools', 'media.object.read', 'openvibe.media', ['tools'], ['tools', 'tools.*']],
++    // Live runs media.analyze on OpenVibe.AI (WS-O task 5).
++    ['live', 'ai.run.create', 'openvibe.ai', ['live.*', 'network.site_copy'], ['live.*', 'network.site_copy', 'media.analyze']],
++    ['live', 'ai.run.read', 'openvibe.ai', ['live.*', 'network.site_copy'], ['live.*', 'network.site_copy', 'media.analyze']],
  ];
  
  function ensureSchema(db) {
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 3374634e..dce2f660 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -20,6 +20,9 @@ console.log = log;
  db.prepare("UPDATE oauth_clients SET client_secret = 'live-secret' WHERE client_id = 'live'").run();
  db.prepare("UPDATE oauth_clients SET client_secret = 'media-secret' WHERE client_id = 'media'").run();
  db.prepare("INSERT INTO users (id, username, password_hash) VALUES (7, 'payee', 'x'), (8, 'payer', 'x')").run();
++// A database seeded before media.analyze (Live's AI grants as the old default) is moved at the next boot.
++db.prepare("UPDATE principal_grants SET namespaces = ? WHERE client_id = 'live' AND audience = 'openvibe.ai'").run(JSON.stringify(['live.*', 'network.site_copy']));
++require('../server/identity/principals').ensureSchema(db);
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
  const ISSUER = 'https://openvibe.network';