fix(credits): add attempt_index before indexing it on postgres boot

[Allan-Feng]

Summary

• Render boot of feat: fail over platform credits to CommonStack #432 dies at import: CREATE TABLE IF NOT EXISTS no-ops on the existing Neon credit_llm_reservations table, then CREATE INDEX ... (..., attempt_index) raises UndefinedColumn before the later ADD COLUMN can run.
• Move idx_credit_llm_reservations_run_status into the grant-migration DDL, after ADD COLUMN attempt_index. Drop and recreate the pre-feat: fail over platform credits to CommonStack #432 three-column index so the name matches the new definition.
• Add a source-shape guard (always runs in CI) and a live-Postgres fixture that starts from the fix(credits): remove legacy PostgreSQL settlement ceiling #431 reservation table.

Test plan

• pytest dashboard/backend/tests/domain/credits/test_repository_postgres.py::test_postgres_boot_ddl_indexes_attempt_index_only_after_add_column
• pytest dashboard/backend/tests/test_store_twin_parity.py::test_postgres_twin_schema_columns_match_sqlite
• With TEST_POSTGRES_URL set: pytest dashboard/backend/tests/domain/credits/test_repository_postgres.py::test_postgres_boot_migrates_pre_failover_reservation_table -v
• Merge and confirm Render gets past credits_store backend: postgres (...) without UndefinedColumn: attempt_index

Made with Cursor

[vercel]

@Allan-Feng is attempting to deploy a commit to the allan-feng's projects Team on Vercel.

A member of the Team first needs to authorize it.

[FlyM1ss]

Pushed review follow-ups onto this branch as a merge from main plus c4f294ee (fast-forward, no force-push).

• Kept the DROP INDEX. fix(credits): order postgres attempt index migration #434 merged the same ordering fix without it, but prod has carried idx_credit_llm_reservations_run_status over (run_id, status, call_index) since c0bcd86, and CREATE INDEX IF NOT EXISTS matches by name alone, so main's statement no-ops there. This PR is the only repair of that index.
• Made the repair converge. The drop now fires only when pg_get_indexdef shows a column list other than (run_id, status, call_index, attempt_index). credits_store is built at import, so the unconditional DROP+CREATE rebuilt the index under ACCESS EXCLUSIVE on every deploy. The block sits below the last ALTER on the table; the SQL comment in the base DDL is gone because main's guard asserts the index name is absent there.
• Generalised the guard. test_store_twin_parity now fails any Postgres twin that creates an index above the ADD COLUMN of a column it names. It immediately caught database_postgres.py (two agent_runs indexes on session_id), which is reordered in the same commit.
• Tests. Catalog reads go through pg_get_indexdef / pg_get_constraintdef on the search path (the bare relname filter was unscoped), a second boot must keep the same index OID, and the three credits fixtures share one schema helper. The source guard from the test plan is now test_postgres_boot_ddl_repairs_the_stale_run_status_index_conditionally.

Full backend suite green locally with TEST_POSTGRES_URL on postgres:18; the pre-failover fixture (stale three-column index included) is what reproduces the Render crash.

[FlyM1ss]

Second review pass on c4f294ee; 5 findings, all fixed in b4930aad + 40e6d825 (fast-forward, no force-push).

DDL

• DROP INDEX gains IF EXISTS. The guard's predicate is evaluated before the lock is taken, so two concurrent boots can both reach it; the loser raised index "..." does not exist, aborting _init_schema — fatal, since credits_store is built at import.
• ADD CONSTRAINT ... logical_attempt_key now sits behind a conkey guard. It is a UNIQUE, i.e. exactly the full index build under ACCESS EXCLUSIVE the index repair was written to avoid, on the same table, running unconditionally three lines above it. Column identity comes from pg_constraint.conkey, not a pg_get_constraintdef text match; a mismatch falls back to the previous drop+add.
• The other 12 CHECK/FK rebuilds are left unconditional on purpose — recognising a CHECK means comparing deparsed text, which drifts between versions, and a predicate that silently stops matching converges to nothing while still looking correct. The DO block's comment now says this instead of implying the whole migration converges. Recorded in the spec amendment.

Tests

• The source guard no longer bans the DROP INDEX IF EXISTS spelling — conditionality is the drop's position inside the guard, and the old assertion made the concurrency fix un-landable. Convergence is now pinned live by con.oid + con.conindid; conindid is load-bearing, since a drop and re-add keeps the constraint's name.
• test_store_twin_parity: identifier patterns accept schema-qualified and quoted names (ON public.t(a) and ON "t"(a) previously matched nothing, so such a twin would pass with zero indexes read), SQL -- comments are blanked before parsing, and a new per-twin test asserts every CREATE INDEX keyword actually parses.
• Docstrings claiming source position is execution order now name the counterexample: users_postgres.py executes AUTH_SESSIONS_DDL after later inline ALTERs.

All four new guards mutation-tested. Full backend suite 4111 passed / 46 skipped with the @pg_only tier live against a local postgres:18. CI green; CodeQL python + javascript both results=0 on merge ref 7930b04a.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AVXYsLrNzE1biGsEfj94yL