[rmcdaniel]

Part of #325: the backup-first in-place upgrade gate. Stacked on #532 (which sits on #529 and #523); review those first. Implements the PostgreSQL part of the design in #517.

Takeover

upgrade-takeover now also accepts DB_CONNECTION=pgsql, with the owner's DB_* settings. One read-committed transaction:

1. Takes native's bootstrap advisory key, so no native node can open the database meanwhile.
2. Locks every public table in ACCESS EXCLUSIVE mode. The later DDL needs that mode anyway, so no lock is upgraded while another session waits. A session still holding a table after native's 5 s lock wait refuses the takeover with upgrade_source_in_use.
3. Runs the inventory, queue and payload inspections and recomputes the fingerprint inside that transaction, refusing unless it equals DW_UPGRADE_BACKUP_FINGERPRINT.
4. Adds the native relations, converts the recorded PHP release layout, records the native migration and runs native's startup verification (marker, ledger and full catalog), then commits.

PHP's added columns are each table's last, so dropping them leaves every remaining column at its position, and the catalog check passes.

The layout conversion and the ledger record are now shared by SQLite and PostgreSQL through the Backend trait. The PostgreSQL inspection and fingerprint can run inside the caller's transaction (postgres_inventory, postgres_digest). Fingerprint reads are no longer cut off by the 30 s inspection statement limit: like MySQL's, they are bounded by the client deadline, so large tables can be fingerprinted.

Interruption

A takeover killed before its commit leaves nothing committed. It is rerun with the same digest.

• PostgreSQL: the server ends the killed session's transaction and locks.
• SQLite: the killed run leaves a rollback journal. Read-only inspection still refuses it (upgrade_source_sqlite_journal_unqualified). The writable takeover open now lets SQLite roll the journal back, and the fingerprint check then proves the file is the backed-up one.

Checks

• PostgreSQL qualification tests (runtime::postgres::tests::qualification_takeover_*, run by the postgres-storage job):
  • A PHP 2.9.7-shaped database is converted and opened by native, and a second takeover is refused as upgrade_source_already_owned.
  • The frozen layout is taken over.
  • Each of these is refused with the catalog and every row unchanged: a wrong digest, a malformed digest, a session holding jobs, a write after the backup, a service call, and an external payload.
  • A real takeover process SIGKILLed just before its commit leaves the source unchanged, and the rerun succeeds.
• SQLite unit test: the same SIGKILL test, ending in a successful rerun.
• Upgrade source cohort: the PostgreSQL job now takes over a restored copy of the published-PHP source, starts native on it and resumes the originals, as the SQLite job does. Its timer is short for that reason.
• Local results:
  • The 4 new PostgreSQL tests and all 11 PostgreSQL qualification tests pass.
  • SQLite lib tests pass (128), as do the upgrade tests (41).
  • The cohort passed on PostgreSQL and SQLite for both the default (PHP 2.8.0 layout) and the PHP 2.9.7 sources. In each run, the leased activity completed on its original attempt, the stale task got 409 task_not_leased, the timer fired 0.07–0.17 s after its deadline, both workflows completed and PHP refused with php_database_refused.

Not covered yet

• MySQL and MariaDB takeover. LOCK TABLES refuses to create or drop tables it does not hold, so they need the design's session check and step journal.
• Nested payload columns the inspection does not scan yet.
• Takeover with external payloads or service calls.
• Multi-node qualification.

The report keeps stored_representation_compatibility_verified: false.

🤖 Generated with Claude Code