codexLB-up 1.25.0b10__py3-none-any.whl

app/db/alembic/versions/20260909_130000_add_request_logs_live_facet_indexes.py

@@ -0,0 +1,96 @@
+"""Add live-row partial indexes for the unfiltered request-log facet skip scan.
+
+The unfiltered ``GET /api/request-logs/options`` facets are computed with a
+recursive ``facet_skip`` CTE: one ``min(column) WHERE deleted_at IS NULL AND
+column > previous`` probe per distinct value. The existing facet indexes
+(``idx_logs_model_effort_time``, ``idx_logs_status_error_time``,
+``idx_logs_api_key_time``) carry soft-deleted rows too, so every probe walks
+the whole soft-deleted cohort that shares a value before reaching the next
+live one, and probe cost grows with the number of soft-deleted rows instead of
+the number of distinct values. Partial indexes whose predicate matches the
+probe's ``deleted_at IS NULL`` restore the bounded-probe contract. Account ids
+need no live index: soft deletion detaches ``account_id`` (NULL), which an
+``account_id > previous`` probe never walks.
+
+PostgreSQL builds the indexes with ``CREATE INDEX CONCURRENTLY`` outside the
+migration transaction so the proxy write path keeps inserting, and rebuilds a
+leftover invalid index from an interrupted concurrent build instead of letting
+``IF NOT EXISTS`` accept it by name. SQLite uses plain partial indexes.
+
+Revision ID: 20260909_130000_add_request_logs_live_facet_indexes
+Revises: 20260909_120000_dashboard_conversation_archive
+Create Date: 2026-09-09
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260909_130000_add_request_logs_live_facet_indexes"
+down_revision = "20260909_120000_dashboard_conversation_archive"
+branch_labels = None
+depends_on = None
+
+_TABLE_NAME = "request_logs"
+_LIVE_ROW_PREDICATE = "deleted_at IS NULL"
+_LIVE_FACET_INDEXES: tuple[tuple[str, tuple[str, ...]], ...] = (
+    ("idx_logs_live_api_key", ("api_key_id",)),
+    ("idx_logs_live_model_effort", ("model", "reasoning_effort")),
+    ("idx_logs_live_status_error", ("status", "error_code")),
+)
+
+
+def _drop_invalid_postgres_index(index_name: str) -> None:
+    """Drop a leftover invalid index from an interrupted CREATE INDEX CONCURRENTLY.
+
+    ``IF NOT EXISTS`` would silently accept the invalid index by name, leaving
+    the facet probes without a usable live-row index.
+    """
+    bind = op.get_bind()
+    invalid = bind.execute(
+        sa.text(
+            "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+            "WHERE c.relname = :name AND NOT i.indisvalid"
+        ),
+        {"name": index_name},
+    ).scalar()
+    if invalid:
+        op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {index_name}"))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            for index_name, columns in _LIVE_FACET_INDEXES:
+                _drop_invalid_postgres_index(index_name)
+                op.execute(
+                    sa.text(
+                        f"CREATE INDEX CONCURRENTLY IF NOT EXISTS {index_name} "
+                        f"ON {_TABLE_NAME} ({', '.join(columns)}) WHERE {_LIVE_ROW_PREDICATE}"
+                    )
+                )
+        return
+
+    for index_name, columns in _LIVE_FACET_INDEXES:
+        op.execute(
+            sa.text(
+                f"CREATE INDEX IF NOT EXISTS {index_name} "
+                f"ON {_TABLE_NAME} ({', '.join(columns)}) WHERE {_LIVE_ROW_PREDICATE}"
+            )
+        )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            for index_name, _columns in _LIVE_FACET_INDEXES:
+                op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {index_name}"))
+        return
+
+    for index_name, _columns in _LIVE_FACET_INDEXES:
+        op.drop_index(index_name, table_name=_TABLE_NAME, if_exists=True)

app/db/alembic/versions/20260910_000000_add_totp_required_for_admin_role.py

@@ -0,0 +1,44 @@
+"""Add dashboard_settings.totp_required_for_admin_role (D9: TOTP required for admin-level accounts).
+
+Revision ID: 20260910_000000_add_totp_required_for_admin_role
+Revises: 20260909_040000_add_dashboard_user_invites
+Create Date: 2026-09-10
+
+Boolean, NOT NULL, server default false: existing installs keep today's
+behaviour (only the global ``totp_required_on_login`` toggle applies) until an
+admin turns the new option on from the Settings page. No data backfill.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260910_000000_add_totp_required_for_admin_role"
+down_revision = "20260909_040000_add_dashboard_user_invites"
+branch_labels = None
+depends_on = None
+
+_TABLE = "dashboard_settings"
+_COLUMN = "totp_required_for_admin_role"
+
+
+def _columns(connection: Connection) -> set[str]:
+    if not sa.inspect(connection).has_table(_TABLE):
+        return set()
+    return {column["name"] for column in sa.inspect(connection).get_columns(_TABLE)}
+
+
+def upgrade() -> None:
+    columns = _columns(op.get_bind())
+    if columns and _COLUMN not in columns:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.add_column(sa.Column(_COLUMN, sa.Boolean(), server_default=sa.false(), nullable=False))
+
+
+def downgrade() -> None:
+    columns = _columns(op.get_bind())
+    if columns and _COLUMN in columns:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.drop_column(_COLUMN)

app/db/alembic/versions/20260910_000000_request_logs_missing_cost_index.py

@@ -0,0 +1,52 @@
+"""Index eligible missing costs so background repair never scans priced history."""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260910_000000_request_logs_missing_cost_index"
+down_revision = "20260909_130000_add_request_logs_live_facet_indexes"
+branch_labels = None
+depends_on = None
+
+_NAME = "idx_logs_missing_cost"
+_PREDICATE = (
+    "cost_usd IS NULL AND model_source_id IS NULL AND input_tokens IS NOT NULL "
+    "AND (output_tokens IS NOT NULL OR reasoning_tokens IS NOT NULL) "
+    "AND (model_source_kind IS NULL OR model_source_kind = 'subscription')"
+)
+
+
+def upgrade() -> None:
+    if op.get_bind().dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            invalid = (
+                op.get_bind()
+                .execute(
+                    sa.text(
+                        "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+                        "WHERE c.relname = :name AND NOT i.indisvalid"
+                    ),
+                    {"name": _NAME},
+                )
+                .scalar()
+            )
+            if invalid:
+                op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {_NAME}"))
+            op.execute(
+                sa.text(
+                    f"CREATE INDEX CONCURRENTLY IF NOT EXISTS {_NAME} "
+                    f"ON request_logs (model_source_id, id) WHERE {_PREDICATE}"
+                )
+            )
+        return
+    op.execute(sa.text(f"CREATE INDEX IF NOT EXISTS {_NAME} ON request_logs (model_source_id, id) WHERE {_PREDICATE}"))
+
+
+def downgrade() -> None:
+    if op.get_bind().dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {_NAME}"))
+        return
+    op.drop_index(_NAME, table_name="request_logs", if_exists=True)

app/db/alembic/versions/20260910_010000_add_dashboard_auth_providers.py

@@ -0,0 +1,134 @@
+"""Add dashboard_auth_providers and the invite's expected identity columns.
+
+Revision ID: 20260910_010000_add_dashboard_auth_providers
+Revises: 20260909_040000_add_dashboard_user_invites
+Create Date: 2026-09-10
+
+One row per sign-in method. The two built-in rows (password, trusted header)
+are seeded with "do nothing on conflict" so a re-run never overwrites an
+operator's settings. The trusted-header row defaults unknown identities to the
+admin preset (D10): an upgraded reverse-proxy install keeps admitting every
+identity the proxy vouches for, now as its own account. ``enabled`` is not a
+copy of ``CODEX_LB_DASHBOARD_AUTH_MODE``; the mode is read at request time.
+
+``dashboard_user_invites`` gains the nullable ``expected_*`` triple a
+pre-created account waits for. Existing invites keep NULL (nothing to link).
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+from app.modules.auth_providers.seed import seed_default_auth_providers
+
+revision = "20260910_010000_add_dashboard_auth_providers"
+down_revision = "20260910_000000_add_totp_required_for_admin_role"
+branch_labels = None
+depends_on = None
+
+_TABLE = "dashboard_auth_providers"
+_INVITES = "dashboard_user_invites"
+_INVITE_COLUMNS: tuple[str, ...] = ("expected_provider", "expected_provider_key", "expected_subject")
+_EXPECTED_IDENTITY_INDEX = "uq_dashboard_user_invites_expected_identity"
+_OPEN_INVITE = "consumed_at IS NULL AND revoked_at IS NULL"
+
+
+def _provider_columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column("id", sa.String(length=36), primary_key=True),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("provider_key", sa.String(length=64), nullable=False),
+        sa.Column("enabled", sa.Boolean(), server_default=sa.true(), nullable=False),
+        sa.Column("label", sa.String(length=64), nullable=False),
+        sa.Column("config_encrypted", sa.LargeBinary(), nullable=True),
+        sa.Column("unknown_identity_role_id", sa.String(length=36), nullable=True),
+        sa.Column("no_match_role_id", sa.String(length=36), nullable=True),
+        sa.Column("link_by_email", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("skip_role_sync", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("idp_mfa_enforced", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+
+
+def _create_providers_table() -> None:
+    op.create_table(
+        _TABLE,
+        *_provider_columns(),
+        sa.ForeignKeyConstraint(["unknown_identity_role_id"], ["dashboard_roles.id"], ondelete="SET NULL"),
+        sa.ForeignKeyConstraint(["no_match_role_id"], ["dashboard_roles.id"], ondelete="SET NULL"),
+        sa.UniqueConstraint("kind", "provider_key", name="uq_dashboard_auth_providers_kind_key"),
+    )
+
+
+def _seed_table() -> sa.Table:
+    """Revision-pinned column list for the seed INSERT (no constraints needed to insert)."""
+
+    return sa.Table(_TABLE, sa.MetaData(), *_provider_columns())
+
+
+def _invite_columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column("expected_provider", sa.String(length=32), nullable=True),
+        sa.Column("expected_provider_key", sa.String(length=128), nullable=True),
+        sa.Column("expected_subject", sa.String(length=512), nullable=True),
+    )
+
+
+def _existing_columns(inspector: sa.Inspector, table: str) -> set[str]:
+    if not inspector.has_table(table):
+        return set()
+    return {column["name"] for column in inspector.get_columns(table)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_TABLE):
+        _create_providers_table()
+    # Outside the table guard so a re-run after a partial failure still seeds.
+    seed_default_auth_providers(bind, _seed_table())
+
+    existing = _existing_columns(inspector, _INVITES)
+    missing = [column for column in _invite_columns() if column.name not in existing]
+    if missing:
+        with op.batch_alter_table(_INVITES) as batch_op:
+            for column in missing:
+                batch_op.add_column(column)
+    if inspector.has_table(_INVITES) and _EXPECTED_IDENTITY_INDEX not in _index_names(bind):
+        # One open invite per expected identity (partial: consumed/revoked rows do not count).
+        op.create_index(
+            _EXPECTED_IDENTITY_INDEX,
+            _INVITES,
+            list(_INVITE_COLUMNS),
+            unique=True,
+            postgresql_where=sa.text(_OPEN_INVITE),
+            sqlite_where=sa.text(_OPEN_INVITE),
+        )
+
+
+def _index_names(bind: sa.engine.Connection) -> set[str]:
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_INVITES):
+        return set()
+    return {name for index in inspector.get_indexes(_INVITES) if isinstance(name := index.get("name"), str)}
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if _EXPECTED_IDENTITY_INDEX in _index_names(bind):
+        op.drop_index(_EXPECTED_IDENTITY_INDEX, table_name=_INVITES)
+    present = _existing_columns(inspector, _INVITES)
+    to_drop = [name for name in _INVITE_COLUMNS if name in present]
+    if to_drop:
+        with op.batch_alter_table(_INVITES) as batch_op:
+            for name in to_drop:
+                batch_op.drop_column(name)
+    if inspector.has_table(_TABLE):
+        op.drop_table(_TABLE)

app/db/alembic/versions/20260910_010000_dashboard_spool_retention.py

@@ -0,0 +1,52 @@
+"""add dashboard-managed HTTP bridge operation spool retention column
+
+One nullable ``dashboard_settings`` FLOAT column named after the ``Settings``
+field it takes over:
+``http_responses_session_bridge_operation_spool_retention_seconds``. NULL means
+"inherit": the deprecated
+``CODEX_LB_HTTP_RESPONSES_SESSION_BRIDGE_OPERATION_SPOOL_RETENTION_SECONDS``
+environment alias, then the code default (7 days), keep applying until an
+operator sets a value in the dashboard's data retention card. The environment
+value is never copied into the column (configuration-tiers; slop-removal
+campaign 0908, R2).
+
+Revision ID: 20260910_010000_dashboard_spool_retention
+Revises: 20260910_000000_request_logs_missing_cost_index
+Create Date: 2026-09-10
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260910_010000_dashboard_spool_retention"
+down_revision = "20260910_000000_request_logs_missing_cost_index"
+branch_labels = None
+depends_on = None
+
+_SETTINGS_TABLE = "dashboard_settings"
+_COLUMN_NAME = "http_responses_session_bridge_operation_spool_retention_seconds"
+
+
+def _column_names(connection: Connection, table_name: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(table_name) if column.get("name") is not None}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    existing_columns = _column_names(bind, _SETTINGS_TABLE)
+    if existing_columns and _COLUMN_NAME not in existing_columns:
+        with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+            batch_op.add_column(sa.Column(_COLUMN_NAME, sa.Float(), nullable=True))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if _COLUMN_NAME in _column_names(bind, _SETTINGS_TABLE):
+        with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+            batch_op.drop_column(_COLUMN_NAME)

app/db/alembic/versions/20260910_020000_add_dashboard_role_mappings.py

@@ -0,0 +1,74 @@
+"""Add dashboard_role_mappings.
+
+Revision ID: 20260910_020000_add_dashboard_role_mappings
+Revises: 20260910_010000_add_dashboard_auth_providers
+Create Date: 2026-09-10
+
+One row per "identities like this get that role" rule of a sign-in provider.
+The table is created empty: an upgrade introduces no rule, and a provider
+without rules re-evaluates nobody (D10), so the behaviour of an existing
+install is unchanged until an operator adds the first rule.
+
+``UNIQUE(provider, provider_key, priority)`` is declared inline because SQLite
+cannot add a constraint to an existing table; ``role_id`` is RESTRICT so a role
+a rule hands out cannot be deleted while the rule exists.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260910_020000_add_dashboard_role_mappings"
+down_revision = "20260910_010000_add_dashboard_auth_providers"
+branch_labels = None
+depends_on = None
+
+_TABLE = "dashboard_role_mappings"
+_PROVIDER_INDEX = "idx_dashboard_role_mappings_provider"
+_PRIORITY_CONSTRAINT = "uq_dashboard_role_mappings_priority"
+
+
+def _columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column("id", sa.String(length=36), primary_key=True),
+        sa.Column("provider", sa.String(length=32), nullable=False),
+        sa.Column("provider_key", sa.String(length=64), nullable=False),
+        sa.Column("claim_name", sa.String(length=32), nullable=False),
+        sa.Column("claim_value", sa.String(length=320), nullable=False),
+        sa.Column("role_id", sa.String(length=36), nullable=False),
+        sa.Column("priority", sa.Integer(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+
+
+def _index_names(bind: sa.engine.Connection) -> set[str]:
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_TABLE):
+        return set()
+    return {name for index in inspector.get_indexes(_TABLE) if isinstance(name := index.get("name"), str)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not inspector.has_table(_TABLE):
+        op.create_table(
+            _TABLE,
+            *_columns(),
+            sa.ForeignKeyConstraint(["role_id"], ["dashboard_roles.id"], ondelete="RESTRICT"),
+            sa.UniqueConstraint("provider", "provider_key", "priority", name=_PRIORITY_CONSTRAINT),
+        )
+    if _PROVIDER_INDEX not in _index_names(bind):
+        op.create_index(_PROVIDER_INDEX, _TABLE, ["provider", "provider_key"])
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if _PROVIDER_INDEX in _index_names(bind):
+        op.drop_index(_PROVIDER_INDEX, table_name=_TABLE)
+    if sa.inspect(bind).has_table(_TABLE):
+        op.drop_table(_TABLE)

app/db/alembic/versions/20260910_143000_request_log_affinity.py

@@ -0,0 +1,28 @@
+"""Persist nullable resolved affinity metadata on request logs."""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260910_143000_request_log_affinity"
+down_revision = "20260910_010000_dashboard_spool_retention"
+branch_labels = None
+depends_on = None
+
+_COLUMNS = ("sticky_key_source", "sticky_kind", "sticky_key_hash")
+
+
+def upgrade() -> None:
+    existing = {column["name"] for column in sa.inspect(op.get_bind()).get_columns("request_logs")}
+    # Legacy bootstrap can start with the current ORM schema already present.
+    with op.batch_alter_table("request_logs") as batch_op:
+        for name in _COLUMNS:
+            if name not in existing:
+                batch_op.add_column(sa.Column(name, sa.String(), nullable=True))
+
+
+def downgrade() -> None:
+    existing = {column["name"] for column in sa.inspect(op.get_bind()).get_columns("request_logs")}
+    with op.batch_alter_table("request_logs") as batch_op:
+        for name in reversed(_COLUMNS):
+            if name in existing:
+                batch_op.drop_column(name)

app/db/alembic/versions/20260910_180000_merge_affinity_guest_heads.py

@@ -0,0 +1,17 @@
+"""Merge affinity observation and guest-session migration histories."""
+
+revision = "20260910_180000_merge_affinity_guest_heads"
+down_revision = (
+    "20260910_143000_request_log_affinity",
+    "20260908_000000_add_guest_session_generation",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260910_200000_merge_affinity_identity_heads.py

@@ -0,0 +1,17 @@
+"""Merge affinity observation and dashboard identity migration histories."""
+
+revision = "20260910_200000_merge_affinity_identity_heads"
+down_revision = (
+    "20260910_180000_merge_affinity_guest_heads",
+    "20260909_030000_add_audit_actor_columns",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260910_220000_merge_affinity_invite_heads.py

@@ -0,0 +1,17 @@
+"""Merge published affinity identity and dashboard invite histories."""
+
+revision = "20260910_220000_merge_affinity_invite_heads"
+down_revision = (
+    "20260910_200000_merge_affinity_identity_heads",
+    "20260909_040000_add_dashboard_user_invites",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260911_000000_model_source_pins_kind_expires_index.py

@@ -0,0 +1,43 @@
+"""Index the live thread-pin count so a dashboard poll never walks model_source_pins."""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260911_000000_model_source_pins_kind_expires_index"
+down_revision = "20260910_020000_add_dashboard_role_mappings"
+branch_labels = None
+depends_on = None
+
+_NAME = "ix_model_source_pins_kind_expires_at"
+_COLUMNS = "(kind, expires_at)"
+
+
+def upgrade() -> None:
+    if op.get_bind().dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            invalid = (
+                op.get_bind()
+                .execute(
+                    sa.text(
+                        "SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid "
+                        "WHERE c.relname = :name AND NOT i.indisvalid"
+                    ),
+                    {"name": _NAME},
+                )
+                .scalar()
+            )
+            if invalid:
+                op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {_NAME}"))
+            op.execute(sa.text(f"CREATE INDEX CONCURRENTLY IF NOT EXISTS {_NAME} ON model_source_pins {_COLUMNS}"))
+        return
+    op.execute(sa.text(f"CREATE INDEX IF NOT EXISTS {_NAME} ON model_source_pins {_COLUMNS}"))
+
+
+def downgrade() -> None:
+    if op.get_bind().dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            op.execute(sa.text(f"DROP INDEX CONCURRENTLY IF EXISTS {_NAME}"))
+        return
+    op.drop_index(_NAME, table_name="model_source_pins", if_exists=True)

app/db/alembic/versions/20260911_010000_merge_pin_index_and_affinity_heads.py

@@ -0,0 +1,17 @@
+"""Merge the model-source pin index and published affinity histories."""
+
+revision = "20260911_010000_merge_pin_index_and_affinity_heads"
+down_revision = (
+    "20260911_000000_model_source_pins_kind_expires_index",
+    "20260910_220000_merge_affinity_invite_heads",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260911_020000_add_http_bridge_terminal_append_phase.py

@@ -0,0 +1,54 @@
+"""record where an HTTP bridge operation stands in its terminal append
+
+Revision ID: 20260911_020000_add_http_bridge_terminal_append_phase
+Revises: 20260911_010000_merge_pin_index_and_affinity_heads
+Create Date: 2026-09-11
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260911_020000_add_http_bridge_terminal_append_phase"
+down_revision = "20260911_010000_merge_pin_index_and_affinity_heads"
+branch_labels = None
+depends_on = None
+
+_TABLE = "http_bridge_operations"
+_COLUMN = "terminal_append_phase"
+
+
+def _has_table(connection: Connection) -> bool:
+    return sa.inspect(connection).has_table(_TABLE)
+
+
+def _has_column(connection: Connection) -> bool:
+    return any(item["name"] == _COLUMN for item in sa.inspect(connection).get_columns(_TABLE))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if not _has_table(bind) or _has_column(bind):
+        return
+    # ``pending`` for every existing row is the correct backfill. The column
+    # fences the terminal transcript write of one dispatch, and no row written
+    # before this revision carries such a fence: a legacy terminal append
+    # committed ``event_spool_complete = true`` in the same transaction, and
+    # the legacy fallback settlement left no distinguishing mark. Backfilling
+    # anything stricter would refuse the terminal append of operations that are
+    # in flight across the upgrade, which is precisely the fail-closed shape
+    # this column exists to avoid: an ordinary operation is already
+    # ``state = completed`` with an incomplete spool while its terminal append
+    # runs, because the relay publishes the operation state first.
+    op.add_column(
+        _TABLE,
+        sa.Column(_COLUMN, sa.String(length=16), nullable=False, server_default=sa.text("'pending'")),
+    )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if _has_table(bind) and _has_column(bind):
+        op.drop_column(_TABLE, _COLUMN)