fix(server): reconcile historical V2 migration manifests

[saphid]

What Changed

Older Orchestrator V2 databases recorded the same migrations under IDs starting at 44 or 45. Startup now validates the complete recorded prefix, shifts those V2 records to their current IDs while preserving timestamps, applies the missing main migrations, and then continues with pending migrations.

Reconciliation and normal migration run in one transaction. An unknown or partial historical manifest, an invalid migration ceiling, or a later migration failure rolls back both the schema and migration-history changes.

Why

Without reconciliation, startup can replay DDL that an older V2 build already applied or skip main migrations inserted before the current V2 sequence.

Validation

• 17 focused migration tests passed across the three known historical cohorts, partial and unknown manifests, idempotent startup, preserved import progress, and rollback during reconciliation or later migrations.
• Scoped server typecheck and targeted lint passed.
• A Codex worker checked that the historical migration bodies match their current equivalents.
• A direct Claude Opus 5 high review attempt exited 1 during OAuth authentication; no Claude model ran.

No live historical user database was exercised.

Stack

Targets the Orchestrator V2 branch in #2829. That architecture is not present on current main.

Implemented by GPT-6 and reviewed by a Codex worker in Codex/T3.

Current-base verification

Updated to exact V2 base 415ed0f73b97f1655b6282492f81d0b2bba3a9cc at 718bc3f8cfa995cf64709ef8c53b53a9fdfeb25b. The historical-ledger reconciliation remains absent from that base and its stable patch ID is unchanged. The focused migration suite passed 10/10 tests; server typecheck, targeted lint, and git diff --check passed. Typecheck emitted only existing advisory Effect suggestions outside this contribution.

The #10051 bridge has already absorbed this repair for its own integration, but the repair is still required independently by the declared V2 base; this PR should remain open. No live historical user database was exercised. Fresh independent Claude review remains unavailable because its OAuth credentials are expired. Refreshed by GPT-6 in Codex/T3.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the production startup migration path, including transactional manifest renumbering and replay of previously skipped schema/data migrations for historical databases. That stateful database-upgrade behavior has material operational impact beyond the test-only additions and warrants human review.

No code changes detected at 718bc3f. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.