railwatch 0.9.3 → 1.0.0

data/db/railwatch_telemetry_migrate/20260903000008_add_profiles_and_attachments.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-# Sampled CPU/wall profiles for an execution, attachments (files an app
-# attaches to an execution or exception), and opt-in captured bodies.
-class AddProfilesAndAttachments < ActiveRecord::Migration[8.1]
-  def change
-    create_table :profiles do |t|
-      # The record envelope as it was when this migration shipped; inlined so
-      # the history never calls a model that has since changed.
-      t.datetime :occurred_at, null: false, precision: 6
-      t.string :deploy, limit: 128
-      t.string :server, limit: 255
-      t.string :group_hash, limit: 32
-      t.string :trace_id, limit: 36
-      t.string :execution_source, limit: 20
-      t.string :execution_id, limit: 36
-      t.string :execution_preview, limit: 255
-      t.string :execution_stage, limit: 32
-      t.string :user_ref, limit: 255
-      t.string :app_tenant, limit: 255
-      t.string :profiler, null: false, limit: 16         # vernier, stackprof
-      t.string :mode, limit: 8                           # wall, cpu
-      t.integer :interval                                # microseconds between samples
-      t.integer :duration, null: false                   # microseconds profiled
-      t.integer :samples, null: false                    # total samples collected
-      t.binary :stacks, null: false                      # gzip of collapsed stacks: "frame;frame;frame count\n"
-      t.integer :stacks_bytes                            # uncompressed size
-    end
-    add_index :profiles, [ :execution_id ]
-    add_index :profiles, [ :group_hash, :occurred_at ]
-    add_index :profiles, [ :occurred_at ]
-
-    create_table :attachments do |t|
-      # The record envelope as it was when this migration shipped; inlined so
-      # the history never calls a model that has since changed.
-      t.datetime :occurred_at, null: false, precision: 6
-      t.string :deploy, limit: 128
-      t.string :server, limit: 255
-      t.string :group_hash, limit: 32
-      t.string :trace_id, limit: 36
-      t.string :execution_source, limit: 20
-      t.string :execution_id, limit: 36
-      t.string :execution_preview, limit: 255
-      t.string :execution_stage, limit: 32
-      t.string :user_ref, limit: 255
-      t.string :app_tenant, limit: 255
-      t.string :name, null: false, limit: 255
-      t.string :content_type, limit: 128
-      t.integer :bytes, null: false
-      t.binary :data, null: false                        # gzip
-      t.string :exception_group_hash, limit: 32          # set when attached to an exception
-    end
-    add_index :attachments, [ :execution_id ]
-    add_index :attachments, [ :exception_group_hash, :occurred_at ]
-    add_index :attachments, [ :occurred_at ]
-
-    add_column :outgoing_requests, :response_body, :text  # captured on error only, truncated
-    add_column :executions, :profile_id, :integer         # denormalised: the execution has a profile
-  end
-end

data/db/railwatch_telemetry_migrate/20260903000009_add_truncated_to_attachments.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-# The gem cuts an attachment off at its size limit and flags the wire
-# record; without this column the UI cannot tell a whole file from a stub.
-class AddTruncatedToAttachments < ActiveRecord::Migration[8.1]
-  def change
-    add_column :attachments, :truncated, :boolean, default: false, null: false
-  end
-end

data/db/railwatch_telemetry_migrate/20260903000010_create_sessions_and_release_health.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-# Release health. `sessions` are the raw records the gem ships -- one per
-# browser tab and per authenticated/cookied server session, repeated every
-# flush interval, so a session id appears many times and the rollup keeps the
-# worst status it saw. `release_health` is the hourly aggregate per deploy
-# (the release) that the crash-free rates are read from.
-class CreateSessionsAndReleaseHealth < ActiveRecord::Migration[8.1]
-  def change
-    create_table :sessions do |t|
-      # The record envelope as it was when this migration shipped; inlined so
-      # the history never calls a model that has since changed.
-      t.datetime :occurred_at, null: false, precision: 6
-      t.string :deploy, limit: 128
-      t.string :server, limit: 255
-      t.string :group_hash, limit: 32
-      t.string :trace_id, limit: 36
-      t.string :execution_source, limit: 20
-      t.string :execution_id, limit: 36
-      t.string :execution_preview, limit: 255
-      t.string :execution_stage, limit: 32
-      t.string :user_ref, limit: 255
-      t.string :app_tenant, limit: 255
-      t.string :session_id, null: false, limit: 64
-      t.string :source, limit: 16                        # browser, server
-      t.string :status, limit: 16                        # started, ok, errored, crashed
-      t.datetime :started_at, precision: 6
-      t.integer :duration                                # microseconds, null until the session has one
-      t.integer :requests, default: 0
-      t.integer :visits, default: 0
-      t.integer :error_count, default: 0            # `errors` is a reserved Active Record name
-      t.boolean :ended, default: false
-    end
-    add_index :sessions, [ :session_id, :occurred_at ]
-    add_index :sessions, [ :deploy, :occurred_at ]
-    add_index :sessions, [ :occurred_at ]
-
-    create_table :release_health do |t|
-      t.string :deploy, null: false, limit: 128
-      t.datetime :bucket, null: false, precision: 6
-      t.integer :sessions, default: 0
-      t.integer :sessions_errored, default: 0
-      t.integer :sessions_crashed, default: 0
-      t.integer :users, default: 0
-      t.integer :users_crashed, default: 0
-      t.bigint :duration_sum, default: 0
-      t.integer :duration_count, default: 0
-    end
-    add_index :release_health, [ :deploy, :bucket ], unique: true
-  end
-end

data/db/railwatch_telemetry_migrate/20260903000011_add_fingerprint_to_exceptions.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-# The parts the gem hashed this exception into an issue on, and where they
-# came from (its own default, a resolver, a per-call fingerprint, or the
-# error class itself) -- so an issue can show why it grouped the way it did.
-class AddFingerprintToExceptions < ActiveRecord::Migration[8.1]
-  def change
-    add_column :exceptions, :fingerprint, :json, default: [], null: false
-    add_column :exceptions, :fingerprint_source, :string, limit: 16
-  end
-end

data/db/railwatch_telemetry_migrate/20260904000012_add_failed_to_broadcasts.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-# Whether a channel action raised. The gem reports the exception itself
-# (source "application.action_cable"); this flag lets the Broadcasts page mark
-# the failed action alongside its siblings, the way jobs and mail already do.
-class AddFailedToBroadcasts < ActiveRecord::Migration[8.1]
-  def change
-    add_column :broadcasts, :failed, :boolean, default: false, null: false
-  end
-end

data/db/railwatch_telemetry_migrate/20260904010000_add_filter_cursor_indexes.rb

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-# Keyset pagination orders every telemetry list by (sort column, id), so an
-# index that stops at the sort column still leaves SQLite sorting ties in a
-# temp B-tree. Each index below ends in id for that reason, and exists only
-# where the leading filter column is selective enough that seeking beats
-# scanning the ordering index and filtering.
-#
-# Deliberately NOT indexed, even though the FilterBar exposes them:
-# exceptions.handled, queries.connection, queries.role, and executions.queue
-# all carry a handful of distinct values in practice, so the existing ordering
-# index plus a row filter is as good as a seek and costs nothing on write.
-class AddFilterCursorIndexes < ActiveRecord::Migration[8.1]
-  def change
-    # Jobs page, filtered by tenant. index_executions_on_app_tenant_and_occurred_at
-    # cannot serve it: the page is already restricted to kind = "job".
-    add_index :executions, [ :kind, :app_tenant, :occurred_at, :id ], name: "idx_executions_kind_tenant_cursor"
-    # "Failed jobs" is the most-used view on that page and failures are rare,
-    # so the two-valued outcome column is highly selective here.
-    add_index :executions, [ :kind, :outcome, :occurred_at, :id ], name: "idx_executions_kind_outcome_cursor"
-
-    # exceptions has only (occurred_at); both of these filters are per-tenant
-    # or per-class needles in a large table.
-    add_index :exceptions, [ :app_tenant, :occurred_at, :id ], name: "idx_exceptions_tenant_cursor"
-    add_index :exceptions, [ :class_name, :occurred_at, :id ], name: "idx_exceptions_class_cursor"
-
-    add_index :logs, [ :app_tenant, :occurred_at, :id ], name: "idx_logs_tenant_cursor"
-    # Replaced, not added: the same index with the keyset tiebreaker appended.
-    remove_index :logs, [ :level, :occurred_at ], name: "index_logs_on_level_and_occurred_at"
-    add_index :logs, [ :level, :occurred_at, :id ], name: "idx_logs_level_cursor"
-
-    # The queries page sorts by duration, which index_queries_on_occurred_at_and_duration
-    # cannot order by. The first index serves the unfiltered page.
-    add_index :queries, [ :duration, :id ], name: "idx_queries_duration_cursor"
-    add_index :queries, [ :app_tenant, :duration, :id ], name: "idx_queries_tenant_duration_cursor"
-  end
-end

data/db/railwatch_telemetry_migrate/20260904020000_add_n_plus_ones_execution_id_index.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-# n_plus_ones had no execution_id index, alone among the child tables, so
-# every trace page and every get_route call that asked "which N+1s did
-# these requests hit" scanned the table: 1.6 s at 70k rows on the
-# platform's own tenant, and it only grows.
-class AddNPlusOnesExecutionIdIndex < ActiveRecord::Migration[8.1]
-  def change
-    add_index :n_plus_ones, :execution_id, name: "index_n_plus_ones_on_execution_id"
-  end
-end

data/db/railwatch_telemetry_migrate/20260904120000_create_query_shapes.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-# A query group's normalized statement, stored once; rows that carry
-# exactly it store "" instead (docs/architecture.md). queries.sql keeps
-# its NOT NULL: relaxing it would rewrite the table on every tenant, which
-# SQLite cannot do in place and the deploy's health window cannot afford.
-class CreateQueryShapes < ActiveRecord::Migration[8.1]
-  def change
-    create_table :query_shapes, id: false do |t|
-      t.string :group_hash, null: false, limit: 32
-      t.text :sql, null: false
-    end
-    add_index :query_shapes, :group_hash, unique: true
-  end
-end

data/db/railwatch_telemetry_migrate/20260906120000_add_backpressure_factor_to_ingest_batches.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-# The gem reports when load forces it to sample every execution kind, so the
-# platform can distinguish quiet traffic from reduced client-side reporting.
-class AddBackpressureFactorToIngestBatches < ActiveRecord::Migration[8.1]
-  def change
-    add_column :ingest_batches, :backpressure_factor, :float, null: false, default: 1.0
-  end
-end

data/db/railwatch_telemetry_migrate/20260907000000_rename_lantern_version_on_processes.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-# The gem version a process reports. Column renamed with the platform; the
-# ingest mapper accepts both wire spellings while environments still run the
-# lantern gem.
-class RenameLanternVersionOnProcesses < ActiveRecord::Migration[8.1]
-  def change
-    rename_column :processes, :lantern_version, :nightrail_version
-  end
-end

data/db/railwatch_telemetry_migrate/20260913000000_rename_nightrail_version_on_processes.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-# The gem version a process reports. Column renamed with the platform; the
-# ingest mapper still accepts the pinned lantern gem's wire spelling.
-class RenameNightrailVersionOnProcesses < ActiveRecord::Migration[8.1]
-  def change
-    rename_column :processes, :nightrail_version, :railwatch_version
-  end
-end

data/db/railwatch_telemetry_migrate/20260914000000_drop_orphan_durable_ingest_tables.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-# Telemetry half of the primary migration of the same name: #84's
-# rollup_cursors and source_maps, and #60's release_health_finalizations,
-# stayed behind in every tenant after their code was reverted or replaced.
-class DropOrphanDurableIngestTables < ActiveRecord::Migration[8.1]
-  ORPHAN_TABLES = %w[release_health_finalizations rollup_cursors source_maps].freeze
-  ORPHAN_VERSIONS = %w[20260904000013 20260905000100 20260905000200 20260905000400].freeze
-
-  def up
-    ORPHAN_TABLES.each { |table| drop_table table, if_exists: true }
-    execute "DELETE FROM schema_migrations WHERE version IN (#{ORPHAN_VERSIONS.map { |v| "'#{v}'" }.join(", ")})"
-  end
-
-  def down
-    raise ActiveRecord::IrreversibleMigration, "the dropped tables belonged to reverted code; there is nothing to restore"
-  end
-end

data/db/railwatch_telemetry_migrate/20260914010000_drop_orphan_durable_ingest_columns.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-# The column half of the #84 cleanup (see 20260914000000): its migrations
-# also added delivery-state columns to ingest_batches and resolved-frame
-# columns to exceptions in every tenant before the code was reverted in
-# 5521379. Nothing reads them, and the weekly restore drill fails the
-# column comparison on every restored tenant. Indexes go first: SQLite
-# refuses to drop an indexed column.
-class DropOrphanDurableIngestColumns < ActiveRecord::Migration[8.1]
-  def up
-    remove_index :ingest_batches, :followups_completed_at, if_exists: true
-    remove_index :ingest_batches, :delivery_key, if_exists: true
-    remove_index :ingest_batches, :batch_id, if_exists: true
-    %i[batch_id delivery_key followups followups_completed_at].each do |column|
-      remove_column :ingest_batches, column if column_exists?(:ingest_batches, column)
-    end
-    %i[resolved_frames resolved_frames_key].each do |column|
-      remove_column :exceptions, column if column_exists?(:exceptions, column)
-    end
-  end
-
-  def down
-    raise ActiveRecord::IrreversibleMigration, "the dropped columns belonged to reverted code; there is nothing to restore"
-  end
-end

data/db/railwatch_telemetry_migrate/20260915000000_create_llm_calls.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-# One row per RubyLLM call: a model call of any operation, or a tool
-# invocation (operation "tool", which carries a name and a duration but no
-# tokens or cost). Token counts keep RubyLLM's normalized buckets rather
-# than a provider's own names, and cost is nanodollars so a month of rollup
-# sums stays exact -- nil there means unpriced, never free.
-class CreateLlmCalls < ActiveRecord::Migration[8.1]
-  def change
-    create_table :llm_calls do |t|
-      # The record envelope as it was when this migration shipped; inlined so
-      # the history never calls a model that has since changed.
-      t.datetime :occurred_at, null: false, precision: 6
-      t.string :deploy, limit: 128
-      t.string :server, limit: 255
-      t.string :group_hash, limit: 32
-      t.string :trace_id, limit: 36
-      t.string :execution_source, limit: 20
-      t.string :execution_id, limit: 36
-      t.string :execution_preview, limit: 255
-      t.string :execution_stage, limit: 32
-      t.string :user_ref, limit: 255
-      t.string :app_tenant, limit: 255
-      t.string :operation, null: false, limit: 20
-      t.string :provider, limit: 64
-      t.string :model, limit: 255
-      t.string :response_model, limit: 255
-      t.string :tool_name, limit: 255
-      t.integer :duration, null: false
-      t.string :status, limit: 16
-      t.string :error, limit: 255
-      t.boolean :streaming
-      t.integer :message_count
-      t.integer :tool_count
-      t.integer :input_tokens
-      t.integer :output_tokens
-      t.integer :cache_read_tokens
-      t.integer :cache_write_tokens
-      t.integer :thinking_tokens
-      t.bigint :cost_nanos
-      # Present only for calls made inside RubyLLM.workflow (2.0 and up).
-      # The parent step id is what reconstructs a nested agent run.
-      t.string :workflow_id, limit: 64
-      t.string :workflow_name, limit: 255
-      t.string :workflow_step_id, limit: 64
-      t.string :workflow_step_name, limit: 255
-      t.string :workflow_step_parent_id, limit: 64
-      t.text :prompt
-      t.text :completion
-    end
-    add_index :llm_calls, [ :group_hash, :occurred_at ]
-    add_index :llm_calls, [ :execution_id ]
-    add_index :llm_calls, [ :workflow_id, :occurred_at ]
-  end
-end

data/db/railwatch_telemetry_migrate/20260915120000_add_detail_to_llm_calls.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-# What an LLM call carried and how it was configured, alongside what it
-# cost. finish_reason is the one that changes what you can see: max_tokens
-# means the answer was cut off, and a truncated extraction otherwise reads
-# exactly like a complete one.
-class AddDetailToLlmCalls < ActiveRecord::Migration[8.1]
-  def change
-    change_table :llm_calls, bulk: true do |t|
-      t.string :finish_reason, limit: 32
-      t.string :provider_request_id, limit: 128
-      t.string :tools, limit: 1024
-      t.boolean :cost_reported
-      t.integer :attachments
-      t.string :attachment_types, limit: 128
-      t.string :attachment_names, limit: 1024
-      t.string :tool_call_id, limit: 128
-      t.json :params
-    end
-  end
-end

data/db/railwatch_telemetry_migrate/20260915200000_add_explained_index_to_queries.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-# The queries page asks "which of these 200 shapes have a captured plan in
-# the window?" -- WHERE occurred_at BETWEEN ? AND ? AND group_hash IN (200
-# values) AND explain IS NOT NULL. The planner walks the (group_hash,
-# occurred_at) index for every one of the 200 shapes and then checks
-# `explain` on each row, which is 840 ms at one day of one environment's
-# queries (1M rows), and that whole time is a GVL hold: sqlite3-ruby does
-# not release the GVL inside sqlite3_step. Plans are only captured for slow
-# queries, so a partial index over just the explained rows is tiny and
-# answers the question in 4 ms.
-class AddExplainedIndexToQueries < ActiveRecord::Migration[8.1]
-  def change
-    add_index :queries, [ :group_hash, :occurred_at ], name: "idx_queries_explained", where: "explain IS NOT NULL"
-  end
-end

data/db/railwatch_telemetry_migrate/20260915210000_add_slowest_index_to_queries.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-# The queries page's "slowest in window" list orders the window by duration
-# and takes a page. Every existing index leads with occurred_at, so the
-# planner scans the whole window and sorts it: 48 ms for a day of one
-# environment's queries (1M rows) -- and sqlite3-ruby holds the GVL for the
-# whole statement, so every other request thread waits too. An index that
-# leads with (duration DESC, id DESC) matches the page's ORDER BY exactly, so
-# SQLite walks it from the slowest row and stops at the page (microseconds,
-# and it cannot get worse as the table grows); occurred_at rides along so
-# the window filter is answered from the index too. The planner still
-# prefers the occurred_at index on its own cost model, so CursorPage forces
-# this one.
-class AddSlowestIndexToQueries < ActiveRecord::Migration[8.1]
-  def change
-    add_index :queries, [ :duration, :id, :occurred_at ], name: "idx_queries_slowest", order: { duration: :desc, id: :desc }
-  end
-end

data/db/railwatch_telemetry_migrate/20260917010000_add_batch_ledger_to_ingest_batches.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-# Delivery ledger for in-process ingest. The reporter gives every batch a
-# stable id before the first attempt; recording it on the ingest_batches row
-# inside the batch transaction lets a retry ask "did this commit?" instead of
-# guessing, and lets the follow-up work the batch still owes (exception
-# grouping, which writes the other database) be resumed after a crash.
-# `followups` is the small outbox: nil once everything has run.
-class AddBatchLedgerToIngestBatches < ActiveRecord::Migration[8.1]
-  def change
-    add_column :ingest_batches, :batch_id, :string, limit: 36
-    add_column :ingest_batches, :followups, :json
-    add_index :ingest_batches, :batch_id, unique: true
-    add_index :ingest_batches, :received_at, where: "followups IS NOT NULL", name: "index_ingest_batches_pending_followups"
-  end
-end

data/db/railwatch_telemetry_migrate/20260919000100_create_export_queue.rb

@@ -1,146 +0,0 @@
-# frozen_string_literal: true
-
-# The durable queue an embedded install uses to mirror its telemetry to a
-# remote receiver.
-#
-# Why the bodies are stored rather than re-derived from the rows next door:
-# the rows are not a reversible copy of what was sent. Mapping renames and
-# drops fields, caps strings, swaps a query's SQL for a shape reference and
-# coalesces people; and ingest rejects records the receiver may well accept,
-# so sending only what we kept would not be the same telemetry. A delivery
-# therefore keeps the exact bytes it will send, and frees them the moment it
-# reaches a terminal state -- the cost tracks what is unacknowledged, not what
-# is stored.
-#
-# Nothing here is written unless export is explicitly enabled.
-#
-# Every statement is if_not_exists, because this migration has run before
-# under another number. Through 0.5.0 it was 20260919000000; 0.5.1 moved it
-# here so it could not collide with a host's own telemetry migration at that
-# number (Railwatch Cloud has one). An install upgrading from 0.5.0 or older
-# therefore already holds every table, index and column below, recorded
-# under the old version, and sees this one as pending: a plain create_table
-# raised "table export_destinations already exists" in db:prepare, which a
-# deploy runs before the app boots. The old run is detected by what it
-# built, not by its version, because on a host like Railwatch Cloud the old
-# number belongs to a different migration.
-#
-# Rolling back has the mirror problem: on a database that came through the
-# old number, these tables and columns -- and anything queued in them -- are
-# the old version's, which stays recorded as applied. So down leaves them
-# alone there, and reverses the migration everywhere else.
-class CreateExportQueue < ActiveRecord::Migration[8.1]
-  OLD_VERSION = 20260919000000
-
-  def up
-    build_queue
-  end
-
-  def down
-    if built_under_old_number?
-      say("left in place: #{OLD_VERSION} built this queue under its pre-0.5.1 number and is still recorded as applied")
-    else
-      revert { build_queue }
-    end
-  end
-
-  private
-    # The old version is recorded, and no migration file this database knows
-    # of claims it: only the gem's own pre-0.5.1 CreateExportQueue did.
-    def built_under_old_number?
-      context = connection.pool.migration_context
-      context.get_all_versions.include?(OLD_VERSION) && context.migrations.none? { |m| m.version == OLD_VERSION }
-    end
-
-    def build_queue
-      # One row per destination this database has ever been pointed at.
-      create_table :export_destinations, if_not_exists: true do |t|
-        t.string :url, null: false
-        t.string :url_sha256, limit: 64, null: false
-        # Permanent for this database's lineage: it is how the receiver tells
-        # our deliveries from another installation's.
-        t.string :producer_id, limit: 36, null: false
-        # A fingerprint, never the token. If the token changes, queued bytes
-        # must not follow it to whatever tenant the new one belongs to.
-        t.string :credential_sha256, limit: 64, null: false
-
-        t.string :state, limit: 16, null: false, default: "ready"
-        t.datetime :retry_at, precision: 6
-        t.string :reason, limit: 64
-
-        t.string :lease_owner, limit: 36
-        t.bigint :lease_generation, null: false, default: 0
-        t.datetime :lease_expires_at, precision: 6
-
-        # Live totals, maintained in the same transaction as the rows they
-        # describe, so admission can be decided without counting the table.
-        t.bigint :queued_bytes, null: false, default: 0
-        t.bigint :queued_deliveries, null: false, default: 0
-        # Lifetime accounting: acked, rejected, expired, discarded, shed.
-        t.json :counters, null: false, default: {}
-
-        t.timestamps
-      end
-
-      add_index :export_destinations, :url_sha256, unique: true, if_not_exists: true
-      add_index :export_destinations, :producer_id, unique: true, if_not_exists: true
-
-      create_table :export_deliveries, if_not_exists: true do |t|
-        t.references :export_destination, null: false, foreign_key: true
-        # A UUIDv7: its embedded time is how the receiver ages it out, so a
-        # delivery cannot be made young again by relabelling it.
-        t.string :delivery_id, limit: 36, null: false
-        # What this delivery is a delivery OF. One per source batch today; a
-        # future policy that selects across batches supplies its own key.
-        t.string :selection_key, limit: 160, null: false
-
-        t.binary :body
-        t.string :body_sha256, limit: 64, null: false
-        t.string :metadata_sha256, limit: 64, null: false
-        t.bigint :body_bytes, null: false
-        t.bigint :ndjson_bytes, null: false
-        t.integer :record_count, null: false
-        # Everything about the delivery that is not its body: version, drop
-        # counts, backpressure. Digested into metadata_sha256 so the same id
-        # arriving with different counts is a conflict, not an update.
-        t.json :wire_metadata, null: false, default: {}
-
-        t.string :state, limit: 8, null: false, default: "pending"
-        # Set only when done: acked, rejected, expired, discarded.
-        t.string :disposition, limit: 16
-        t.datetime :enqueued_at, null: false, precision: 6
-        t.datetime :expires_at, null: false, precision: 6
-        t.datetime :next_attempt_at, null: false, precision: 6
-        t.bigint :attempts, null: false, default: 0
-
-        t.string :claim_token, limit: 36
-        t.bigint :claim_generation
-        t.datetime :claim_expires_at, precision: 6
-
-        t.integer :last_status
-        t.string :last_reason, limit: 64
-        t.json :ack
-        t.datetime :finished_at, precision: 6
-
-        t.timestamps
-      end
-
-      add_index :export_deliveries, %i[export_destination_id delivery_id], unique: true,
-        name: "index_export_deliveries_on_destination_and_delivery", if_not_exists: true
-      # One delivery per selection: a batch replayed into the same transaction
-      # cannot enqueue itself twice.
-      add_index :export_deliveries, %i[export_destination_id selection_key], unique: true,
-        name: "index_export_deliveries_on_destination_and_selection", if_not_exists: true
-      add_index :export_deliveries, %i[export_destination_id id], where: "state <> 'done'",
-        name: "index_export_deliveries_live", if_not_exists: true
-      add_index :export_deliveries, :expires_at, where: "body IS NOT NULL",
-        name: "index_export_deliveries_expiring", if_not_exists: true
-      add_index :export_deliveries, :finished_at, where: "state = 'done'",
-        name: "index_export_deliveries_finished", if_not_exists: true
-
-      # Why a batch did or did not enqueue anything. Null on every row an
-      # install without export ever writes.
-      add_column :ingest_batches, :export_disposition, :string, limit: 24, if_not_exists: true
-      add_column :ingest_batches, :export_record_count, :bigint, if_not_exists: true
-    end
-end

data/db/railwatch_telemetry_migrate/20260922000000_add_covering_indexes_for_dashboard_aggregates.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-# Two dashboard aggregates read every row in the window and only a few
-# narrow columns of each: the Jobs page's per-queue breakdown and the
-# Processes page's health series. Through (kind, occurred_at) and
-# (sampled_at) SQLite finds the rows in order but then fetches each one
-# from the table, and on a telemetry file much larger than memory those
-# rows are scattered pages on disk. On the platform's own 30 GB tenant,
-# over a week: 38 s for the queue breakdown (491,000 job attempts) and
-# 19 s for the health series (263,000 samples), with the GVL held the
-# whole time, so every other request in the process waited too.
-#
-# Both indexes carry every column their query reads, so the whole answer
-# comes from one contiguous index range: 335 ms and 370 ms on a copy of
-# the same file. They cost 151 MB and 29 MB there, and took 13 s and 2 s
-# to build.
-#
-# broadcasts is the one windowed table with no index led by occurred_at,
-# so the Broadcasts page's "recent" list sorted the whole window to show
-# 100 rows. Every other raw table has had this index since it was created.
-#
-# Free-text search over jobs and requests also matches the exception
-# preview, which only a failed execution carries (15 of 491,000 job
-# attempts in that same week). A partial index over just those rows lets
-# Execution.named_like seek them instead of reading the window.
-class AddCoveringIndexesForDashboardAggregates < ActiveRecord::Migration[8.1]
-  def change
-    add_index :executions, [ :kind, :occurred_at, :queue, :outcome, :queue_latency ], name: "idx_executions_queue_stats", if_not_exists: true
-    add_index :health_samples, [ :sampled_at, :threads_max, :threads_busy, :backlog, :queue_depth, :queue_latency ],
-              name: "idx_health_samples_series", if_not_exists: true
-    add_index :broadcasts, :occurred_at, if_not_exists: true
-    add_index :executions, [ :kind, :occurred_at ], name: "idx_executions_with_preview", where: "exception_preview IS NOT NULL", if_not_exists: true
-  end
-end

data/db/railwatch_telemetry_migrate/20260923000000_add_people_index.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-# The People page groups the window's signed-in requests by user_ref.
-# Through (user_ref, occurred_at) SQLite found those rows but fetched each
-# one from the table for kind and status: 4 s over 30 days on the
-# platform's own tenant, where 18,000 of 2.8 million executions carry a
-# user. This index holds every column the query reads, and only for rows
-# that have a user, so it answers in 18 ms from under a megabyte. It took
-# 10 s to build on a copy of that 30 GB file.
-class AddPeopleIndex < ActiveRecord::Migration[8.1]
-  def change
-    add_index :executions, [ :user_ref, :kind, :occurred_at, :status ], name: "idx_executions_people",
-              where: "user_ref IS NOT NULL", if_not_exists: true
-  end
-end

data/db/railwatch_telemetry_migrate/20260925000000_add_tenant_summary_index.rb

@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-# The Tenants page and MCP's list_tenants sum every tenant-tagged request
-# and job in the window per tenant. Through (app_tenant, occurred_at)
-# SQLite finds the rows but fetches each from the table for kind, status,
-# outcome, duration and user_ref: 8.1 s over 30 days on rebulk-system
-# (358,000 tagged requests), and 24 s once in production, which held the
-# web process -- and every ingest request queued behind it -- the whole
-# time. This index carries every column those aggregates read, only for
-# tagged rows: 131 ms for the same query, 41 MB, 1.6 s to build on a copy
-# of that 16 GB file. An untagged app gets an empty index.
-class AddTenantSummaryIndex < ActiveRecord::Migration[8.1]
-  def change
-    add_index :executions, [ :kind, :app_tenant, :occurred_at, :status, :outcome, :duration, :user_ref ],
-              name: "idx_executions_tenant_summary", where: "app_tenant IS NOT NULL", if_not_exists: true
-  end
-end

data/db/railwatch_telemetry_migrate/20261008000000_add_in_transaction_to_outgoing_requests.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-# An outgoing HTTP call made while the execution held a database transaction
-# open: the transaction (and on SQLite with BEGIN IMMEDIATE, the writer lock)
-# stays held for the whole round trip. Same meaning as queries.in_transaction.
-class AddInTransactionToOutgoingRequests < ActiveRecord::Migration[8.1]
-  def change
-    add_column :outgoing_requests, :in_transaction, :boolean, default: false
-  end
-end