codexLB-up 1.25.0b10__py3-none-any.whl

app/db/alembic/versions/20260806_000000_add_additional_usage_alias_probe_indexes.py

@@ -0,0 +1,84 @@
+"""Add alias probe indexes for additional-usage latest-per-account reads.
+
+The PostgreSQL latest-per-account read is being reshaped from a
+``DISTINCT ON`` scan over every row under a quota key into correlated
+per-account top-1 probes. Canonical probes ride the existing
+``ix_additional_usage_quota_window_latest``; the registry's ``limit_name``
+and ``metered_feature`` aliases match through ``lower(...)`` and therefore
+need expression twins so each alias probe is a single btree descent too.
+
+Revision ID: 20260806_000000_add_additional_usage_alias_probe_indexes
+Revises: 20260804_230000_add_request_log_connection_request_kind
+Create Date: 2026-08-06 00:00:00.000000
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260806_000000_add_additional_usage_alias_probe_indexes"
+down_revision = "20260804_230000_add_request_log_connection_request_kind"
+branch_labels = None
+depends_on = None
+
+_ALIAS_INDEXES = (
+    ("ix_additional_usage_alias_limit_latest", "lower(limit_name)"),
+    ("ix_additional_usage_alias_feature_latest", "lower(metered_feature)"),
+)
+
+
+def _drop_invalid_postgres_index(index_name: str) -> None:
+    """Drop a leftover invalid index from an interrupted CREATE INDEX CONCURRENTLY.
+
+    ``IF NOT EXISTS`` would silently accept the invalid index by name,
+    leaving the alias probes without a usable index.
+    """
+    bind = op.get_bind()
+    invalid = bind.execute(
+        sa.text(
+            "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+            "WHERE c.relname = :name AND NOT i.indisvalid"
+        ),
+        {"name": index_name},
+    ).scalar()
+    if invalid:
+        op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {index_name}"))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            for index_name, expression in _ALIAS_INDEXES:
+                _drop_invalid_postgres_index(index_name)
+                op.execute(
+                    sa.text(
+                        f"""
+                        CREATE INDEX CONCURRENTLY IF NOT EXISTS {index_name}
+                        ON additional_usage_history (
+                            {expression}, "window", account_id,
+                            recorded_at DESC, used_percent DESC, id DESC
+                        )
+                        """
+                    )
+                )
+    else:
+        for index_name, expression in _ALIAS_INDEXES:
+            op.execute(
+                sa.text(
+                    f"""
+                    CREATE INDEX IF NOT EXISTS {index_name}
+                    ON additional_usage_history (
+                        {expression}, "window", account_id,
+                        recorded_at DESC, used_percent DESC, id DESC
+                    )
+                    """
+                )
+            )
+
+
+def downgrade() -> None:
+    for index_name, _expression in _ALIAS_INDEXES:
+        op.drop_index(index_name, table_name="additional_usage_history", if_exists=True)

app/db/alembic/versions/20260806_000000_add_anonymous_telemetry.py

@@ -0,0 +1,49 @@
+"""add anonymous telemetry identity and consent
+
+Revision ID: 20260806_000000_add_anonymous_telemetry
+Revises: 20260812_000000_merge_recovery_dispatch_and_hourly_cancelled_heads
+Create Date: 2026-08-06
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260806_000000_add_anonymous_telemetry"
+down_revision = "20260812_000000_merge_recovery_dispatch_and_hourly_cancelled_heads"
+branch_labels = None
+depends_on = None
+
+
+def _columns() -> set[str]:
+    return {column["name"] for column in sa.inspect(op.get_bind()).get_columns("dashboard_settings")}
+
+
+def upgrade() -> None:
+    columns = _columns()
+    with op.batch_alter_table("dashboard_settings") as batch_op:
+        if "telemetry_consent" not in columns:
+            batch_op.add_column(
+                sa.Column(
+                    "telemetry_consent",
+                    sa.String(length=16),
+                    server_default=sa.text("'undecided'"),
+                    nullable=False,
+                )
+            )
+        if "telemetry_instance_id" not in columns:
+            batch_op.add_column(sa.Column("telemetry_instance_id", sa.String(length=36), nullable=True))
+        if "telemetry_private_key_encrypted" not in columns:
+            batch_op.add_column(sa.Column("telemetry_private_key_encrypted", sa.LargeBinary(), nullable=True))
+
+
+def downgrade() -> None:
+    columns = _columns()
+    with op.batch_alter_table("dashboard_settings") as batch_op:
+        if "telemetry_private_key_encrypted" in columns:
+            batch_op.drop_column("telemetry_private_key_encrypted")
+        if "telemetry_instance_id" in columns:
+            batch_op.drop_column("telemetry_instance_id")
+        if "telemetry_consent" in columns:
+            batch_op.drop_column("telemetry_consent")

app/db/alembic/versions/20260806_010000_add_conversation_presence_rollup.py

@@ -0,0 +1,72 @@
+"""add conversation presence rollup table and fold watermark
+
+DDL only — the satellite is created empty and backfill is owned entirely by
+the runtime conversation fold pass, so this revision never blocks startup.
+The watermark column backfills existing state rows to the epoch, so the new
+satellite starts its own paced backfill from zero without touching the
+lifetime or hourly watermarks.
+
+Revision ID: 20260806_010000_add_conversation_presence_rollup
+Revises: 20260806_000000_add_additional_usage_alias_probe_indexes
+Create Date: 2026-08-06
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260806_010000_add_conversation_presence_rollup"
+down_revision = "20260806_000000_add_additional_usage_alias_probe_indexes"
+branch_labels = None
+depends_on = None
+
+_TABLE = "request_conversation_hourly_rollups"
+_STATE_TABLE = "account_usage_rollup_state"
+_WATERMARK_COLUMN = "conversation_folded_through"
+
+
+def _columns(connection: Connection, table_name: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(table_name) if column.get("name") is not None}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    if not sa.inspect(bind).has_table(_TABLE):
+        op.create_table(
+            _TABLE,
+            sa.Column("bucket_epoch", sa.BigInteger(), nullable=False),
+            sa.Column("conversation_id", sa.String(), nullable=False),
+            sa.Column("account_id", sa.String(), nullable=False),
+            sa.Column("is_deleted", sa.Boolean(), server_default=sa.false(), nullable=False),
+            sa.Column("request_count", sa.BigInteger(), server_default=sa.text("0"), nullable=False),
+            sa.PrimaryKeyConstraint("bucket_epoch", "conversation_id", "account_id", "is_deleted"),
+        )
+
+    state_columns = _columns(bind, _STATE_TABLE)
+    if state_columns and _WATERMARK_COLUMN not in state_columns:
+        with op.batch_alter_table(_STATE_TABLE) as batch_op:
+            batch_op.add_column(
+                sa.Column(
+                    _WATERMARK_COLUMN,
+                    sa.DateTime(),
+                    server_default=sa.text("'1970-01-01 00:00:00'"),
+                    nullable=False,
+                )
+            )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+
+    if _WATERMARK_COLUMN in _columns(bind, _STATE_TABLE):
+        with op.batch_alter_table(_STATE_TABLE) as batch_op:
+            batch_op.drop_column(_WATERMARK_COLUMN)
+
+    if sa.inspect(bind).has_table(_TABLE):
+        op.drop_table(_TABLE)

app/db/alembic/versions/20260806_020000_add_usage_history_bulk_covering_indexes.py

@@ -0,0 +1,99 @@
+"""Add covering indexes for the projections bulk usage-history fetch.
+
+The dashboard projections bulk read selects six narrow columns from
+``usage_history`` but every index matching its predicate shapes is a pure
+key index, so PostgreSQL fetches the heap for every matched row (avg 2.0 s
+on the reference deployment). These covering twins carry the selected
+columns in an ``INCLUDE`` payload so the read can be served index-only:
+one for the coalesced-primary window shape and one for the explicit
+raw-window shape (``secondary`` is a live dashboard path).
+
+Non-PostgreSQL backends create the same-named indexes with key columns
+only (``INCLUDE`` unsupported), mirroring ``20260717_000000``: SQLite
+serves this read from its snapshot cache and never runs the SQL shape, so
+the twins exist for schema/drift parity with the ``models.py``
+declarations.
+
+Revision ID: 20260806_020000_add_usage_history_bulk_covering_indexes
+Revises: 20260730_000000_add_api_key_fair_share_threshold
+Create Date: 2026-08-06 02:00:00.000000
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260806_020000_add_usage_history_bulk_covering_indexes"
+down_revision = "20260730_000000_add_api_key_fair_share_threshold"
+branch_labels = None
+depends_on = None
+
+# The coalesced index carries the raw "window" column in its payload: the
+# planner only considers an index-only scan when every column referenced by
+# the query is returnable from the index, and expression key columns cannot
+# return their underlying raw column, so without it the coalesce(...) qual
+# disqualifies the index-only path (verified on PostgreSQL 18).
+_COVERING_INDEXES = (
+    (
+        "idx_usage_window_account_time_covering",
+        "coalesce(\"window\", 'primary')",
+        'used_percent, reset_at, window_minutes, id, "window"',
+    ),
+    (
+        "idx_usage_window_raw_account_time_covering",
+        '"window"',
+        "used_percent, reset_at, window_minutes, id",
+    ),
+)
+
+
+def _drop_invalid_postgres_index(index_name: str) -> None:
+    """Drop a leftover invalid index from an interrupted CREATE INDEX CONCURRENTLY.
+
+    ``IF NOT EXISTS`` would silently accept the invalid index by name,
+    leaving the bulk fetch without a usable covering index.
+    """
+    bind = op.get_bind()
+    invalid = bind.execute(
+        sa.text(
+            "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+            "WHERE c.relname = :name AND NOT i.indisvalid"
+        ),
+        {"name": index_name},
+    ).scalar()
+    if invalid:
+        op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {index_name}"))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            for index_name, window_expression, include_columns in _COVERING_INDEXES:
+                _drop_invalid_postgres_index(index_name)
+                op.execute(
+                    sa.text(
+                        f"""
+                        CREATE INDEX CONCURRENTLY IF NOT EXISTS {index_name}
+                        ON usage_history ({window_expression}, account_id, recorded_at)
+                        INCLUDE ({include_columns})
+                        """
+                    )
+                )
+    else:
+        for index_name, window_expression, _include_columns in _COVERING_INDEXES:
+            op.execute(
+                sa.text(
+                    f"""
+                    CREATE INDEX IF NOT EXISTS {index_name}
+                    ON usage_history ({window_expression}, account_id, recorded_at)
+                    """
+                )
+            )
+
+
+def downgrade() -> None:
+    for index_name, _window_expression, _include_columns in _COVERING_INDEXES:
+        op.drop_index(index_name, table_name="usage_history", if_exists=True)

app/db/alembic/versions/20260806_030000_add_api_key_allowed_reasoning_efforts.py

@@ -0,0 +1,65 @@
+"""add API-key reasoning effort allowlists
+
+The nullable column preserves the existing unrestricted policy for every
+existing API key. New writes serialize a non-empty canonical JSON list.
+
+Revision ID: 20260806_030000_add_api_key_allowed_reasoning_efforts
+Revises: 20260816_000000_add_account_pending_deletion
+Create Date: 2026-08-06 03:00:00.000000
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260806_030000_add_api_key_allowed_reasoning_efforts"
+down_revision = "20260816_000000_add_account_pending_deletion"
+branch_labels = None
+depends_on = None
+
+_TABLE = "api_keys"
+_COLUMN = "allowed_reasoning_efforts"
+_POLICY_CHECK = "ck_api_keys_reasoning_policy_exclusive"
+
+
+def _columns(connection: Connection) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(_TABLE) if column.get("name") is not None}
+
+
+def _check_constraints(connection: Connection) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {str(constraint["name"]) for constraint in inspector.get_check_constraints(_TABLE) if constraint.get("name")}
+
+
+def upgrade() -> None:
+    connection = op.get_bind()
+    columns = _columns(connection)
+    if _COLUMN not in columns:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.add_column(sa.Column(_COLUMN, sa.Text(), nullable=True))
+
+    constraints = _check_constraints(connection)
+    if _POLICY_CHECK not in constraints:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.create_check_constraint(
+                _POLICY_CHECK,
+                f"{_COLUMN} IS NULL OR enforced_reasoning_effort IS NULL",
+            )
+
+
+def downgrade() -> None:
+    connection = op.get_bind()
+    columns = _columns(connection)
+    if _COLUMN not in columns:
+        return
+    with op.batch_alter_table(_TABLE) as batch_op:
+        if _POLICY_CHECK in _check_constraints(connection):
+            batch_op.drop_constraint(_POLICY_CHECK, type_="check")
+        batch_op.drop_column(_COLUMN)

app/db/alembic/versions/20260806_120000_add_http_bridge_owner_process_epoch.py

@@ -0,0 +1,57 @@
+"""add owner process epoch to durable HTTP bridge sessions
+
+Revision ID: 20260806_120000_add_http_bridge_owner_process_epoch
+Revises: 20260808_000000_tune_usage_history_autovacuum
+Create Date: 2026-08-06 12:00:00.000000
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260806_120000_add_http_bridge_owner_process_epoch"
+down_revision = "20260808_000000_tune_usage_history_autovacuum"
+branch_labels = None
+depends_on = None
+
+_TABLE = "http_bridge_sessions"
+_COLUMN = "owner_process_epoch"
+
+
+def _columns(connection: Connection) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(_TABLE) if column.get("name") is not None}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if _COLUMN in _columns(bind):
+        return
+    with op.batch_alter_table(_TABLE) as batch_op:
+        batch_op.add_column(sa.Column(_COLUMN, sa.String(length=64), nullable=True))
+    op.drop_index("idx_http_bridge_sessions_owner_state", table_name=_TABLE, if_exists=True)
+    op.create_index(
+        "idx_http_bridge_sessions_owner_state",
+        _TABLE,
+        ["owner_instance_id", _COLUMN, "state"],
+        if_not_exists=True,
+    )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if _COLUMN not in _columns(bind):
+        return
+    op.drop_index("idx_http_bridge_sessions_owner_state", table_name=_TABLE, if_exists=True)
+    op.create_index(
+        "idx_http_bridge_sessions_owner_state",
+        _TABLE,
+        ["owner_instance_id", "state"],
+        if_not_exists=True,
+    )
+    with op.batch_alter_table(_TABLE) as batch_op:
+        batch_op.drop_column(_COLUMN)

app/db/alembic/versions/20260807_000000_merge_http_bridge_operation_spool_and_latest_main.py

@@ -0,0 +1,24 @@
+"""merge the durable HTTP bridge ledger with the current release head.
+
+The operation-ledger revisions were authored on the recovery branch while
+main continued to receive additive schema revisions.  This no-op merge keeps
+Alembic at one head without rewriting either already-applied lineage.
+"""
+
+from __future__ import annotations
+
+revision = "20260807_000000_merge_http_bridge_operation_spool_and_latest_main"
+down_revision = (
+    "20260806_120000_add_http_bridge_owner_process_epoch",
+    "20260805_000001_finalize_http_bridge_operation_spool",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260808_000000_tune_usage_history_autovacuum.py

@@ -0,0 +1,54 @@
+"""Tune usage_history autovacuum so the covering read path stays index-only.
+
+The covering indexes from ``20260806_020000`` only pay off while the
+visibility map is fresh: ``usage_history`` is append-heavy (high-frequency
+usage snapshots, no updates or deletes), and PostgreSQL's default
+insert-driven autovacuum trigger (20% of the table) lets the freshly
+appended pages sit without an all-visible bit for a long time, turning the
+"index-only" scan into one heap fetch per row — exactly the regression the
+covering indexes were built to remove. This was observed on the reference
+deployment and resolved by manually applying the settings below plus a
+one-off ``VACUUM ANALYZE``; this revision codifies the settings.
+
+Mirrors ``20260717_000000_optimize_dashboard_hot_path_indexes``, which set
+the same parameters on the other two insert-heavy tables
+(``request_logs``, ``additional_usage_history``). ``ALTER TABLE ... SET``
+is idempotent, so re-applying on a deployment that already carries the
+manual settings is harmless. Non-PostgreSQL backends are a no-op (SQLite
+has no visibility map and serves this read from its snapshot cache).
+
+Revision ID: 20260808_000000_tune_usage_history_autovacuum
+Revises: 20260806_020000_add_usage_history_bulk_covering_indexes
+Create Date: 2026-08-08 00:00:00.000000
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260808_000000_tune_usage_history_autovacuum"
+down_revision = "20260806_020000_add_usage_history_bulk_covering_indexes"
+branch_labels = None
+depends_on = None
+
+_POSTGRES_AUTOVACUUM_SETTINGS = (
+    "autovacuum_vacuum_insert_scale_factor = 0.02, "
+    "autovacuum_vacuum_insert_threshold = 50000, "
+    "autovacuum_analyze_scale_factor = 0.02"
+)
+_POSTGRES_AUTOVACUUM_RESET = (
+    "autovacuum_vacuum_insert_scale_factor, autovacuum_vacuum_insert_threshold, autovacuum_analyze_scale_factor"
+)
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        op.execute(sa.text(f"ALTER TABLE usage_history SET ({_POSTGRES_AUTOVACUUM_SETTINGS})"))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        op.execute(sa.text(f"ALTER TABLE usage_history RESET ({_POSTGRES_AUTOVACUUM_RESET})"))

app/db/alembic/versions/20260810_000000_add_http_bridge_recovery_dispatch_count.py

@@ -0,0 +1,44 @@
+"""persist the HTTP bridge ambiguous recovery dispatch budget
+
+Revision ID: 20260810_000000_add_http_bridge_recovery_dispatch_count
+Revises: 20260807_000000_merge_http_bridge_operation_spool_and_latest_main
+Create Date: 2026-08-10
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260810_000000_add_http_bridge_recovery_dispatch_count"
+down_revision = "20260807_000000_merge_http_bridge_operation_spool_and_latest_main"
+branch_labels = None
+depends_on = None
+
+_TABLE = "http_bridge_operations"
+_COLUMN = "recovery_dispatch_count"
+
+
+def _has_table(connection: Connection) -> bool:
+    return sa.inspect(connection).has_table(_TABLE)
+
+
+def _has_column(connection: Connection) -> bool:
+    return any(item["name"] == _COLUMN for item in sa.inspect(connection).get_columns(_TABLE))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if not _has_table(bind) or _has_column(bind):
+        return
+    op.add_column(
+        _TABLE,
+        sa.Column(_COLUMN, sa.Integer(), nullable=False, server_default=sa.text("0")),
+    )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if _has_table(bind) and _has_column(bind):
+        op.drop_column(_TABLE, _COLUMN)

app/db/alembic/versions/20260811_000000_add_hourly_rollup_cancelled_count.py

@@ -0,0 +1,92 @@
+"""add cancelled_count measure to hourly usage rollups
+
+Additive DDL plus one marker stamp: the new measure is populated by the
+hourly fold pass going forward (sum(status = 'cancelled')), and error_count
+narrows to sum(status NOT IN ('success', 'cancelled')) at the same deploy.
+Rows folded before this revision keep the legacy sum(status != 'success')
+error fold and read cancelled_count = 0 via the server default — they are
+deliberately NOT backfilled (raw rows below the watermark may already be
+retention-pruned, so the old fold cannot be re-split), which shows as a
+disclosed step change on error-rate trends (#1552).
+
+Rolling-upgrade fence: this migration runs before old replicas drain, so a
+legacy leader can keep folding (and advancing the shared watermark) with the
+old error fold afterwards. ``account_usage_rollup_state.upgrade_repair_from``
+records where that legacy-suspect range starts: existing state rows are
+stamped with their current ``hourly_folded_through``; the epoch server
+default covers a state row bootstrapped by an OLD replica after this
+migration (its whole backfill is legacy-folded). New code refolds
+``[upgrade_repair_from, hourly_folded_through)`` from raw on its first fold
+pass and then sets the marker to NULL — a value only new code ever writes.
+
+Revision ID: 20260811_000000_add_hourly_rollup_cancelled_count
+Revises: 20260806_120000_add_http_bridge_owner_process_epoch
+Create Date: 2026-08-11
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260811_000000_add_hourly_rollup_cancelled_count"
+down_revision = "20260806_120000_add_http_bridge_owner_process_epoch"
+branch_labels = None
+depends_on = None
+
+_TABLE = "request_usage_hourly_rollups"
+_COLUMN = "cancelled_count"
+_STATE_TABLE = "account_usage_rollup_state"
+_MARKER_COLUMN = "upgrade_repair_from"
+
+
+def _columns(connection: Connection, table_name: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(table_name) if column.get("name") is not None}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    if _COLUMN not in _columns(bind, _TABLE):
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.add_column(
+                sa.Column(
+                    _COLUMN,
+                    sa.BigInteger(),
+                    server_default=sa.text("0"),
+                    nullable=False,
+                )
+            )
+
+    state_columns = _columns(bind, _STATE_TABLE)
+    if state_columns and _MARKER_COLUMN not in state_columns:
+        with op.batch_alter_table(_STATE_TABLE) as batch_op:
+            batch_op.add_column(
+                sa.Column(
+                    _MARKER_COLUMN,
+                    sa.DateTime(),
+                    server_default=sa.text("'1970-01-01 00:00:00'"),
+                    nullable=True,
+                )
+            )
+        # Existing rows: the legacy-suspect range starts at the watermark as
+        # of this migration — everything a legacy leader folds afterwards
+        # lies above it. Rows inserted later by old code keep the epoch
+        # server default (their entire backfill is legacy-suspect).
+        op.execute(sa.text(f"UPDATE {_STATE_TABLE} SET {_MARKER_COLUMN} = hourly_folded_through"))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+
+    if _MARKER_COLUMN in _columns(bind, _STATE_TABLE):
+        with op.batch_alter_table(_STATE_TABLE) as batch_op:
+            batch_op.drop_column(_MARKER_COLUMN)
+
+    if _COLUMN in _columns(bind, _TABLE):
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.drop_column(_COLUMN)

app/db/alembic/versions/20260812_000000_merge_recovery_dispatch_and_hourly_cancelled_heads.py

@@ -0,0 +1,25 @@
+"""merge the recovery-dispatch and hourly-rollup migration heads.
+
+The durable HTTP bridge recovery branch and upstream's cancelled-count rollup
+landed as independent additive revisions.  This no-op merge keeps startup and
+CI migration checks at one canonical Alembic head without rewriting either
+already-applied lineage.
+"""
+
+from __future__ import annotations
+
+revision = "20260812_000000_merge_recovery_dispatch_and_hourly_cancelled_heads"
+down_revision = (
+    "20260810_000000_add_http_bridge_recovery_dispatch_count",
+    "20260811_000000_add_hourly_rollup_cancelled_count",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass