From 4625ef27339b5cc9bc8f264dbc18e5bfe97882bf Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 15 Sep 2025 17:05:07 -0400
Subject: [PATCH 01/17] fix: cover the old default value 1.6 (same as 1.6.4)
 with empty migration

---
 ansible/vars.yml            |  6 ++---
 nix/ext/pg_cron/default.nix | 53 ++++++++++++++++++++-----------------
 2 files changed, 32 insertions(+), 27 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index c0ab29ef87..a6a8e801fb 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.099-orioledb"
-  postgres17: "17.6.1.142"
-  postgres15: "15.14.1.142"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-2"
+  postgres17: "17.6.1.132-pgcron-2"
+  postgres15: "15.14.1.132-pgcron-2"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/nix/ext/pg_cron/default.nix b/nix/ext/pg_cron/default.nix
index a823fa450b..88d68e3cff 100644
--- a/nix/ext/pg_cron/default.nix
+++ b/nix/ext/pg_cron/default.nix
@@ -44,30 +44,35 @@ let
       '';
 
       installPhase = ''
-        mkdir -p $out/{lib,share/postgresql/extension}
-
-        # Install versioned library
-        install -Dm755 ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
-
-
-        if [[ "${version}" == "${latestVersion}" ]]; then
-          cp ${pname}.sql $out/share/postgresql/extension/${pname}--1.0.0.sql
-          # Install upgrade scripts
-          find . -name 'pg_cron--*--*.sql' -exec install -Dm644 {} $out/share/postgresql/extension/ \;
-          mv $out/share/postgresql/extension/pg_cron--1.0--1.1.sql $out/share/postgresql/extension/pg_cron--1.0.0--1.1.0.sql
-          mv $out/share/postgresql/extension/pg_cron--1.1--1.2.sql $out/share/postgresql/extension/pg_cron--1.1.0--1.2.0.sql
-          mv $out/share/postgresql/extension/pg_cron--1.2--1.3.sql $out/share/postgresql/extension/pg_cron--1.2.0--1.3.1.sql
-          mv $out/share/postgresql/extension/pg_cron--1.3--1.4.sql $out/share/postgresql/extension/pg_cron--1.3.1--1.4.2.sql
-          mv $out/share/postgresql/extension/pg_cron--1.4--1.4-1.sql $out/share/postgresql/extension/pg_cron--1.4.0--1.4.1.sql
-          mv $out/share/postgresql/extension/pg_cron--1.4-1--1.5.sql $out/share/postgresql/extension/pg_cron--1.4.2--1.5.2.sql
-          mv $out/share/postgresql/extension/pg_cron--1.5--1.6.sql $out/share/postgresql/extension/pg_cron--1.5.2--1.6.4.sql
-        fi
-
-        # Create versioned control file with modified module path
-        sed -e "/^default_version =/d" \
-            -e "/^schema =/d" \
-            -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
-          ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+                mkdir -p $out/{lib,share/postgresql/extension}
+
+                # Install versioned library
+                install -Dm755 ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
+
+
+                if [[ "${version}" == "${latestVersion}" ]]; then
+                  cp ${pname}.sql $out/share/postgresql/extension/${pname}--1.0.0.sql
+                  # Install upgrade scripts
+                  find . -name 'pg_cron--*--*.sql' -exec install -Dm644 {} $out/share/postgresql/extension/ \;
+                  mv $out/share/postgresql/extension/pg_cron--1.0--1.1.sql $out/share/postgresql/extension/pg_cron--1.0.0--1.1.0.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.1--1.2.sql $out/share/postgresql/extension/pg_cron--1.1.0--1.2.0.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.2--1.3.sql $out/share/postgresql/extension/pg_cron--1.2.0--1.3.1.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.3--1.4.sql $out/share/postgresql/extension/pg_cron--1.3.1--1.4.2.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.4--1.4-1.sql $out/share/postgresql/extension/pg_cron--1.4.0--1.4.1.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.4-1--1.5.sql $out/share/postgresql/extension/pg_cron--1.4.2--1.5.2.sql
+                  mv $out/share/postgresql/extension/pg_cron--1.5--1.6.sql $out/share/postgresql/extension/pg_cron--1.5.2--1.6.4.sql
+                fi
+                  cat > $out/share/postgresql/extension/pg_cron--1.6--1.6.4.sql << 'EOF'
+        -- Version alignment migration
+        -- Both 1.6 and 1.6.4 are actually the same version (1.6.4)
+        -- This file exists only to allow smooth transition from the old naming scheme
+        EOF
+
+                # Create versioned control file with modified module path
+                sed -e "/^default_version =/d" \
+                    -e "/^schema =/d" \
+                    -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
+                  ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
       '';
 
       meta = with lib; {

From d87c5b1847275a189b461f795918f29633b97b84 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Tue, 16 Sep 2025 10:50:09 -0400
Subject: [PATCH 02/17] fix: cover all variations of migration

---
 nix/ext/pg_cron/default.nix | 67 ++++++++++++++++++++++++-------------
 1 file changed, 43 insertions(+), 24 deletions(-)

diff --git a/nix/ext/pg_cron/default.nix b/nix/ext/pg_cron/default.nix
index 88d68e3cff..c4fea00a75 100644
--- a/nix/ext/pg_cron/default.nix
+++ b/nix/ext/pg_cron/default.nix
@@ -44,35 +44,54 @@ let
       '';
 
       installPhase = ''
-                mkdir -p $out/{lib,share/postgresql/extension}
-
-                # Install versioned library
-                install -Dm755 ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
-
-
-                if [[ "${version}" == "${latestVersion}" ]]; then
-                  cp ${pname}.sql $out/share/postgresql/extension/${pname}--1.0.0.sql
-                  # Install upgrade scripts
-                  find . -name 'pg_cron--*--*.sql' -exec install -Dm644 {} $out/share/postgresql/extension/ \;
-                  mv $out/share/postgresql/extension/pg_cron--1.0--1.1.sql $out/share/postgresql/extension/pg_cron--1.0.0--1.1.0.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.1--1.2.sql $out/share/postgresql/extension/pg_cron--1.1.0--1.2.0.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.2--1.3.sql $out/share/postgresql/extension/pg_cron--1.2.0--1.3.1.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.3--1.4.sql $out/share/postgresql/extension/pg_cron--1.3.1--1.4.2.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.4--1.4-1.sql $out/share/postgresql/extension/pg_cron--1.4.0--1.4.1.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.4-1--1.5.sql $out/share/postgresql/extension/pg_cron--1.4.2--1.5.2.sql
-                  mv $out/share/postgresql/extension/pg_cron--1.5--1.6.sql $out/share/postgresql/extension/pg_cron--1.5.2--1.6.4.sql
-                fi
-                  cat > $out/share/postgresql/extension/pg_cron--1.6--1.6.4.sql << 'EOF'
+        mkdir -p $out/{lib,share/postgresql/extension}
+
+        # Install versioned library
+        install -Dm755 ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
+
+
+        if [[ "${version}" == "${latestVersion}" ]]; then
+          cp ${pname}.sql $out/share/postgresql/extension/${pname}--1.0.0.sql
+          # Install upgrade scripts
+          find . -name 'pg_cron--*--*.sql' -exec install -Dm644 {} $out/share/postgresql/extension/ \;
+          mv $out/share/postgresql/extension/pg_cron--1.0--1.1.sql $out/share/postgresql/extension/pg_cron--1.0.0--1.1.0.sql
+          mv $out/share/postgresql/extension/pg_cron--1.1--1.2.sql $out/share/postgresql/extension/pg_cron--1.1.0--1.2.0.sql
+          mv $out/share/postgresql/extension/pg_cron--1.2--1.3.sql $out/share/postgresql/extension/pg_cron--1.2.0--1.3.1.sql
+          mv $out/share/postgresql/extension/pg_cron--1.3--1.4.sql $out/share/postgresql/extension/pg_cron--1.3.1--1.4.2.sql
+          mv $out/share/postgresql/extension/pg_cron--1.4--1.4-1.sql $out/share/postgresql/extension/pg_cron--1.4.0--1.4.1.sql
+          mv $out/share/postgresql/extension/pg_cron--1.4-1--1.5.sql $out/share/postgresql/extension/pg_cron--1.4.2--1.5.2.sql
+          mv $out/share/postgresql/extension/pg_cron--1.5--1.6.sql $out/share/postgresql/extension/pg_cron--1.5.2--1.6.4.sql
+          ln -s pg_cron--1.0.0--1.1.0.sql $out/share/postgresql/extension/pg_cron--1.0--1.1.sql
+          ln -s pg_cron--1.0.0--1.1.0.sql $out/share/postgresql/extension/pg_cron--1.0.0--1.1.sql
+          ln -s pg_cron--1.1.0--1.2.0.sql $out/share/postgresql/extension/pg_cron--1.1--1.2.sql
+          ln -s pg_cron--1.1.0--1.2.0.sql $out/share/postgresql/extension/pg_cron--1.1.0--1.2.sql
+          ln -s pg_cron--1.1.0--1.2.0.sql $out/share/postgresql/extension/pg_cron--1.1--1.2.0.sql
+          ln -s pg_cron--1.2.0--1.3.1.sql $out/share/postgresql/extension/pg_cron--1.2--1.3.sql
+          ln -s pg_cron--1.2.0--1.3.1.sql $out/share/postgresql/extension/pg_cron--1.2.0--1.3.sql
+          ln -s pg_cron--1.2.0--1.3.1.sql $out/share/postgresql/extension/pg_cron--1.2--1.3.1.sql
+          ln -s pg_cron--1.3.1--1.4.2.sql $out/share/postgresql/extension/pg_cron--1.3--1.4.sql
+          ln -s pg_cron--1.3.1--1.4.2.sql $out/share/postgresql/extension/pg_cron--1.3.1--1.4.sql
+          ln -s pg_cron--1.3.1--1.4.2.sql $out/share/postgresql/extension/pg_cron--1.3--1.4.2.sql
+          ln -s pg_cron--1.4.0--1.4.1.sql $out/share/postgresql/extension/pg_cron--1.4--1.4-1.sql
+          ln -s pg_cron--1.4.2--1.5.2.sql $out/share/postgresql/extension/pg_cron--1.4-1--1.5.sql
+          ln -s pg_cron--1.4.2--1.5.2.sql $out/share/postgresql/extension/pg_cron--1.4.2--1.5.sql
+          ln -s pg_cron--1.4.2--1.5.2.sql $out/share/postgresql/extension/pg_cron--1.4-1--1.5.2.sql
+          ln -s pg_cron--1.5.2--1.6.4.sql $out/share/postgresql/extension/pg_cron--1.5--1.6.sql
+          ln -s pg_cron--1.5.2--1.6.4.sql $out/share/postgresql/extension/pg_cron--1.5.2--1.6.sql
+          ln -s pg_cron--1.5.2--1.6.4.sql $out/share/postgresql/extension/pg_cron--1.5--1.6.4.sql
+          cat > $out/share/postgresql/extension/pg_cron--1.6--1.6.4.sql << 'EOF'
         -- Version alignment migration
         -- Both 1.6 and 1.6.4 are actually the same version (1.6.4)
         -- This file exists only to allow smooth transition from the old naming scheme
         EOF
+        fi
 
-                # Create versioned control file with modified module path
-                sed -e "/^default_version =/d" \
-                    -e "/^schema =/d" \
-                    -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
-                  ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+
+        # Create versioned control file with modified module path
+        sed -e "/^default_version =/d" \
+            -e "/^schema =/d" \
+            -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
+          ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
       '';
 
       meta = with lib; {

From 49534d22e2ace5742d048c1466aa0e9d16fd11cc Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Fri, 5 Jun 2026 08:11:25 -0400
Subject: [PATCH 03/17] fix: include aliases and testing to cover legacy format
 of ext versions

---
 nix/ext/pg_cron/default.nix |   5 ++
 nix/ext/tests/default.nix   |  18 ++++++
 nix/ext/tests/lib.py        | 109 ++++++++++++++++++++++++++++++++++++
 3 files changed, 132 insertions(+)

diff --git a/nix/ext/pg_cron/default.nix b/nix/ext/pg_cron/default.nix
index c4fea00a75..8bc14e7c82 100644
--- a/nix/ext/pg_cron/default.nix
+++ b/nix/ext/pg_cron/default.nix
@@ -144,6 +144,11 @@ buildEnv {
     numberOfVersions = numberOfVersionsBuilt;
     inherit switch-ext-version latestOnly;
     hasBackgroundWorker = true;
+    # pg_cron ships symlinked alias scripts and an empty 1.6 -> 1.6.4
+    # alignment migration to cover legacy/non-canonical extversion strings.
+    # Opt in to scanning and exercising every upgrade edge, not just the
+    # canonical chain from versions.json.
+    testAllUpgradeEdges = true;
     defaultSettings = {
       shared_preload_libraries = [ "pg_cron" ];
       "cron.database_name" = "postgres";
diff --git a/nix/ext/tests/default.nix b/nix/ext/tests/default.nix
index 79415c20fe..6b9c23a0f1 100644
--- a/nix/ext/tests/default.nix
+++ b/nix/ext/tests/default.nix
@@ -230,6 +230,12 @@ let
           pg_regress_test_name = "${(installedExtension "15").pgRegressTestName or pname}"
           ext_schema = "${(installedExtension "15").defaultSchema or "public"}"
           lib_name = "${(installedExtension "15").libName or pname}"
+          test_all_upgrade_edges = ${
+            if (installedExtension "15").testAllUpgradeEdges or false then "True" else "False"
+          }
+          ext_dir_15 = "${psql_15}/share/postgresql/extension"
+          ext_dir_17 = "${psql_17}/share/postgresql/extension"
+          ext_dir_orioledb = "${orioledb_17}/share/postgresql/extension"
           print(f"Running tests for extension: {lib_name}")
 
           ${builtins.readFile ./lib.py}
@@ -247,6 +253,10 @@ let
               ''
                 with subtest("Check upgrade path with postgresql 15"):
                   test.check_upgrade_path("15")
+
+                if test_all_upgrade_edges:
+                  with subtest("Check all upgrade edges (incl. legacy aliases) with postgresql 15"):
+                    test.check_all_upgrade_edges("15", ext_dir_15)
               ''
             else
               ""
@@ -306,6 +316,10 @@ let
               ''
                 with subtest("Check upgrade path with postgresql 17"):
                   test.check_upgrade_path("17")
+
+                if test_all_upgrade_edges:
+                  with subtest("Check all upgrade edges (incl. legacy aliases) with postgresql 17"):
+                    test.check_all_upgrade_edges("17", ext_dir_17)
               ''
             else
               ""
@@ -334,6 +348,10 @@ let
                 with subtest("Check upgrade path with orioledb 17"):
                   test.check_upgrade_path("orioledb-17")
 
+                if test_all_upgrade_edges:
+                  with subtest("Check all upgrade edges (incl. legacy aliases) with orioledb 17"):
+                    test.check_all_upgrade_edges("orioledb-17", ext_dir_orioledb)
+
                 with subtest("Check pg_regress with orioledb 17 after installing the last version"):
                   test.check_pg_regress(Path("${orioledb_17}/lib/pgxs/src/test/regress/pg_regress"), "orioledb-17", pg_regress_test_name)
               ''
diff --git a/nix/ext/tests/lib.py b/nix/ext/tests/lib.py
index 26bd42d49c..69e43af3f3 100644
--- a/nix/ext/tests/lib.py
+++ b/nix/ext/tests/lib.py
@@ -133,6 +133,115 @@ def check_upgrade_path(self, pg_version: str):
                 self.drop_extension()
                 self.install_extension(version)
 
+    def discover_upgrade_scripts(self, extension_dir: str):
+        """Discover the install scripts and upgrade edges in extension_dir.
+
+        Lists all ``<ext>--*.sql`` scripts, including symlinked alias scripts
+        (without resolving them), and classifies each:
+
+        - ``<ext>--V.sql`` is a base install script for version ``V``.
+        - ``<ext>--A--B.sql`` is an upgrade edge from ``A`` to ``B``.
+
+        Version strings use single dashes and the separator between versions is
+        a double dash, so splitting the filename's version portion on ``--`` is
+        unambiguous (``1.4-1`` stays intact).
+
+        Args:
+            extension_dir: Directory holding the extension's SQL scripts
+
+        Returns:
+            Tuple of (set of base versions, sorted list of (from, to) edges)
+        """
+        listing = self.vm.succeed(
+            f"ls -1 {extension_dir}/{self.extension_name}--*.sql 2>/dev/null || true"
+        ).strip()
+        prefix = f"{self.extension_name}--"
+        suffix = ".sql"
+        bases = set()
+        edges = set()
+        for line in listing.splitlines():
+            name = Path(line).name
+            if not (name.startswith(prefix) and name.endswith(suffix)):
+                continue
+            core = name[len(prefix) : -len(suffix)]
+            parts = core.split("--")
+            if len(parts) == 1 and parts[0]:
+                bases.add(parts[0])
+            elif len(parts) == 2 and parts[0] and parts[1]:
+                edges.add((parts[0], parts[1]))
+        return bases, sorted(edges)
+
+    @staticmethod
+    def _reachable_versions(bases, edges):
+        """Versions installable via ``CREATE EXTENSION ... VERSION 'V'``.
+
+        Postgres can only create a version it can reach from a base install
+        script by following upgrade edges. A version that only ever appears as
+        an edge *source* (e.g. pg_cron ``1.0``, which has no base script and no
+        incoming edge in this packaging) is not installable on a fresh cluster.
+        """
+        reachable = set(bases)
+        changed = True
+        while changed:
+            changed = False
+            for frm, to in edges:
+                if frm in reachable and to not in reachable:
+                    reachable.add(to)
+                    changed = True
+        return reachable
+
+    def check_all_upgrade_edges(self, pg_version: str, extension_dir: str):
+        """Exercise every reachable upgrade edge, canonical and legacy.
+
+        For each ``<ext>--A--B.sql`` script whose source version ``A`` is
+        installable, create version A from scratch and run
+        ``ALTER EXTENSION ... UPDATE TO 'B'``, asserting the resulting version.
+        This covers symlinked alias scripts and empty version-alignment
+        migrations (e.g. the pg_cron 1.6 -> 1.6.4 no-op) that the canonical
+        check_upgrade_path never reaches because they are absent from
+        versions.json.
+
+        Edges whose source version is unreachable (no base script and no
+        incoming edge, so no fresh cluster can sit at it) are skipped and
+        logged. These never lose script coverage: every such script is a
+        symlink to, or shares its body with, a reachable alias edge that does
+        run (pg_cron ``1.0--1.1`` aliases ``1.0.0--1.1.0``; ``1.4.0--1.4.1``
+        shares its body with the reachable ``1.4--1.4-1`` alias).
+
+        The extension is restored to the latest canonical version on exit so
+        the subtests that follow see the expected state.
+
+        Args:
+            pg_version: PostgreSQL version under test (e.g. "15")
+            extension_dir: Directory holding the extension's SQL scripts
+        """
+        bases, edges = self.discover_upgrade_scripts(extension_dir)
+        if not edges:
+            return
+
+        reachable = self._reachable_versions(bases, edges)
+        testable = [edge for edge in edges if edge[0] in reachable]
+        skipped = [edge for edge in edges if edge[0] not in reachable]
+        if skipped:
+            # Surface, never hide, what was not exercised: a source version
+            # with no install path. If a base script is ever added for one of
+            # these, this line is the cue to start covering it directly.
+            print(
+                f"check_all_upgrade_edges: skipping {len(skipped)} edge(s) "
+                f"with unreachable source version: {skipped}"
+            )
+
+        for from_version, to_version in testable:
+            self.drop_extension()
+            self.install_extension(from_version)
+            self.update_extension(to_version)
+
+        # Restore canonical latest so following subtests have expected state
+        self.drop_extension()
+        available = self.versions.get(pg_version, [])
+        if available:
+            self.install_extension(available[-1])
+
     def check_install_last_version(self, pg_version: str) -> str:
         """Test if the install of the last version of the extension works for a given PostgreSQL version.
 

From 5c0a5dea612ea37adc82f6e8f3488fa430205041 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Sun, 7 Jun 2026 07:49:53 -0400
Subject: [PATCH 04/17] Update nix/ext/tests/lib.py

applying suggestion

Co-authored-by: Artur Zakirov <zaartur@gmail.com>
---
 nix/ext/tests/lib.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nix/ext/tests/lib.py b/nix/ext/tests/lib.py
index 69e43af3f3..4a0b1846d4 100644
--- a/nix/ext/tests/lib.py
+++ b/nix/ext/tests/lib.py
@@ -223,10 +223,7 @@ def check_all_upgrade_edges(self, pg_version: str, extension_dir: str):
         testable = [edge for edge in edges if edge[0] in reachable]
         skipped = [edge for edge in edges if edge[0] not in reachable]
         if skipped:
-            # Surface, never hide, what was not exercised: a source version
-            # with no install path. If a base script is ever added for one of
-            # these, this line is the cue to start covering it directly.
-            print(
+            raise AssertionError(
                 f"check_all_upgrade_edges: skipping {len(skipped)} edge(s) "
                 f"with unreachable source version: {skipped}"
             )

From f1b2347fcab958af7e5e8d67c7d4acc2e49b86fe Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Sun, 7 Jun 2026 10:41:38 -0400
Subject: [PATCH 05/17] test: refine test to cover what is reflected in our
 deployed projects

---
 nix/ext/tests/lib.py | 65 ++++++++++++++++++++++++++++++--------------
 1 file changed, 44 insertions(+), 21 deletions(-)

diff --git a/nix/ext/tests/lib.py b/nix/ext/tests/lib.py
index 4a0b1846d4..f702abbdd0 100644
--- a/nix/ext/tests/lib.py
+++ b/nix/ext/tests/lib.py
@@ -191,22 +191,41 @@ def _reachable_versions(bases, edges):
         return reachable
 
     def check_all_upgrade_edges(self, pg_version: str, extension_dir: str):
-        """Exercise every reachable upgrade edge, canonical and legacy.
+        """Prove every real project state upgrades cleanly to latest.
 
-        For each ``<ext>--A--B.sql`` script whose source version ``A`` is
-        installable, create version A from scratch and run
-        ``ALTER EXTENSION ... UPDATE TO 'B'``, asserting the resulting version.
-        This covers symlinked alias scripts and empty version-alignment
-        migrations (e.g. the pg_cron 1.6 -> 1.6.4 no-op) that the canonical
+        Runs two passes over the upgrade-script graph discovered on disk
+        (including symlinked alias scripts and empty version-alignment
+        migrations such as the pg_cron 1.6 -> 1.6.4 no-op, which the canonical
         check_upgrade_path never reaches because they are absent from
-        versions.json.
-
-        Edges whose source version is unreachable (no base script and no
-        incoming edge, so no fresh cluster can sit at it) are skipped and
-        logged. These never lose script coverage: every such script is a
-        symlink to, or shares its body with, a reachable alias edge that does
-        run (pg_cron ``1.0--1.1`` aliases ``1.0.0--1.1.0``; ``1.4.0--1.4.1``
-        shares its body with the reachable ``1.4--1.4-1`` alias).
+        versions.json):
+
+        1. Per-edge body coverage. For each ``<ext>--A--B.sql`` whose source
+           ``A`` is reachable, create A from scratch and ``UPDATE TO 'B'``,
+           asserting the result. This guarantees every individual alias and
+           alignment script actually executes at least once; a shortest-path
+           upgrade could otherwise route around a broken one.
+
+        2. Full upgrade to latest from every reachable version. For every
+           version a real project could actually sit at -- canonical *or*
+           legacy-alias form -- create it from scratch and run a single
+           ``UPDATE TO '<latest>'``, asserting it lands on the latest
+           canonical version. This is the customer-faithful guarantee: any
+           existing project, whatever extversion string it reports, must reach
+           latest, with Postgres traversing alias edges as needed. If any
+           reachable version cannot reach latest, this pass fails loudly --
+           which is exactly the stranded-project bug we want to catch.
+
+        A version is "reachable" if a fresh cluster can come to rest at it: it
+        has a base install script or an incoming upgrade edge. Versions that
+        are neither (pg_cron ``1.0`` and ``1.4.0``: no base script, no incoming
+        edge) are not real project states -- no database, fresh or upgraded,
+        can ever sit at them -- so neither pass tests them. They lose no script
+        coverage either: each is a symlink to, or shares its body with, a
+        reachable alias edge that pass 1 runs (``1.0--1.1`` aliases
+        ``1.0.0--1.1.0``; ``1.4.0--1.4.1`` shares its body with the reachable
+        ``1.4--1.4-1`` alias). They exist only to keep the version graph
+        connected for legacy extversion strings, a structural property of the
+        package rather than an upgrade this test needs to exercise.
 
         The extension is restored to the latest canonical version on exit so
         the subtests that follow see the expected state.
@@ -219,23 +238,27 @@ def check_all_upgrade_edges(self, pg_version: str, extension_dir: str):
         if not edges:
             return
 
+        available = self.versions.get(pg_version, [])
+        latest = available[-1] if available else None
+
         reachable = self._reachable_versions(bases, edges)
         testable = [edge for edge in edges if edge[0] in reachable]
-        skipped = [edge for edge in edges if edge[0] not in reachable]
-        if skipped:
-            raise AssertionError(
-                f"check_all_upgrade_edges: skipping {len(skipped)} edge(s) "
-                f"with unreachable source version: {skipped}"
-            )
 
+        # Pass 1: every reachable upgrade script executes at least once.
         for from_version, to_version in testable:
             self.drop_extension()
             self.install_extension(from_version)
             self.update_extension(to_version)
 
+        # Pass 2: every reachable version upgrades all the way to latest.
+        if latest is not None:
+            for from_version in sorted(v for v in reachable if v != latest):
+                self.drop_extension()
+                self.install_extension(from_version)
+                self.update_extension(latest)
+
         # Restore canonical latest so following subtests have expected state
         self.drop_extension()
-        available = self.versions.get(pg_version, [])
         if available:
             self.install_extension(available[-1])
 

From 8b7756968f3f6ca74f628dfb72b30fd156fb6fff Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 14:57:21 -0400
Subject: [PATCH 06/17] fix: safely deletes the directory contents while
 preserving /mnt/var/lib/apt/lists itself

---
 ansible/vars.yml                                | 6 +++---
 ebssurrogate/scripts/surrogate-bootstrap-nix.sh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index a6a8e801fb..528e003f78 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-2"
-  postgres17: "17.6.1.132-pgcron-2"
-  postgres15: "15.14.1.132-pgcron-2"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-3"
+  postgres17: "17.6.1.132-pgcron-3"
+  postgres15: "15.14.1.132-pgcron-3"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index 47f3014d13..e74e221881 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -399,7 +399,7 @@ function clean_system {
 	mkdir /mnt/var/log/audit
 
 	# unwanted files
-	rm -rf /mnt/var/lib/apt/lists/*
+	find /mnt/var/lib/apt/lists -mindepth 1 -delete
 	rm -rf /mnt/root/.cache
 	rm -rf /mnt/root/.vpython*
 	rm -rf /mnt/root/go

From 810d560148355cc676b7e30443444016284a422c Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 15:25:07 -0400
Subject: [PATCH 07/17] fix:  xtrace removal and diagnostic trap

---
 ansible/vars.yml                                | 6 +++---
 ebssurrogate/scripts/surrogate-bootstrap-nix.sh | 2 +-
 scripts/90-cleanup.sh                           | 3 ++-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 528e003f78..60f840abc7 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-3"
-  postgres17: "17.6.1.132-pgcron-3"
-  postgres15: "15.14.1.132-pgcron-3"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-4"
+  postgres17: "17.6.1.132-pgcron-4"
+  postgres15: "15.14.1.132-pgcron-4"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index e74e221881..47f3014d13 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -399,7 +399,7 @@ function clean_system {
 	mkdir /mnt/var/log/audit
 
 	# unwanted files
-	find /mnt/var/lib/apt/lists -mindepth 1 -delete
+	rm -rf /mnt/var/lib/apt/lists/*
 	rm -rf /mnt/root/.cache
 	rm -rf /mnt/root/.vpython*
 	rm -rf /mnt/root/go
diff --git a/scripts/90-cleanup.sh b/scripts/90-cleanup.sh
index d221a9f275..2426db489f 100644
--- a/scripts/90-cleanup.sh
+++ b/scripts/90-cleanup.sh
@@ -4,7 +4,8 @@
 # © 2021 DigitalOcean LLC.
 # This code is licensed under Apache 2.0 license (see LICENSE.md for details)
 
-set -ex
+set -o errexit
+trap 'status=$?; echo "[90-cleanup] failed at line ${LINENO}: ${BASH_COMMAND} (exit ${status})" >&2' ERR
 
 # Ensure /tmp exists and has the proper permissions before
 # checking for security updates

From 9c5be597b97b21c9b8b4da69a4b66e5a7f567677 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 16:27:30 -0400
Subject: [PATCH 08/17] test: print diag info

---
 amazon-amd64-nix.pkr.hcl                      |  7 ++++++
 ansible/vars.yml                              |  6 ++---
 .../scripts/surrogate-bootstrap-nix.sh        | 23 ++++++++++---------
 3 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl
index 4543955663..b554db76e7 100644
--- a/amazon-amd64-nix.pkr.hcl
+++ b/amazon-amd64-nix.pkr.hcl
@@ -272,4 +272,11 @@ build {
     destination = "/tmp/ansible.log"
     direction = "download"
   }
+
+  error-cleanup-provisioner "shell" {
+    inline = [
+      "echo '===== /tmp/surrogate-diagnostic.log ====='",
+      "sudo test -f /tmp/surrogate-diagnostic.log && sudo cat /tmp/surrogate-diagnostic.log || echo 'surrogate diagnostic log not found'"
+    ]
+  }
 }
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 60f840abc7..4373ff1aa3 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-4"
-  postgres17: "17.6.1.132-pgcron-4"
-  postgres15: "15.14.1.132-pgcron-4"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-5"
+  postgres17: "17.6.1.132-pgcron-5"
+  postgres15: "15.14.1.132-pgcron-5"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index 47f3014d13..f078a66d9a 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -7,6 +7,7 @@
 # Adapted from: https://github.com/jen20/packer-ubuntu-zfs
 
 set -o errexit
+set -o errtrace
 set -o pipefail
 set -o xtrace
 
@@ -439,17 +440,17 @@ function umount_reset_mappings {
 	done
 }
 
-waitfor_boot_finished
-install_packages
-device_partition_mappings
-format_and_mount_rootfs
-create_swapfile
-format_build_partition
+run_step waitfor_boot_finished waitfor_boot_finished
+run_step install_packages install_packages
+run_step device_partition_mappings device_partition_mappings
+run_step format_and_mount_rootfs format_and_mount_rootfs
+run_step create_swapfile create_swapfile
+run_step format_build_partition format_build_partition
 #pull_docker
-setup_chroot_environment
+run_step setup_chroot_environment setup_chroot_environment
 #download_ccache
-execute_playbook
-update_systemd_services
+run_step execute_playbook execute_playbook
+run_step update_systemd_services update_systemd_services
 #upload_ccache
-clean_system
-umount_reset_mappings
+run_step clean_system clean_system
+run_step umount_reset_mappings umount_reset_mappings

From 30c7127d84a8a762e0054ae06de06aefa5b312b4 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 17:15:30 -0400
Subject: [PATCH 09/17] tests: more daig

---
 amazon-amd64-nix.pkr.hcl | 2 +-
 ansible/vars.yml         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl
index b554db76e7..2630b992b7 100644
--- a/amazon-amd64-nix.pkr.hcl
+++ b/amazon-amd64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
+    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}} >/dev/null 2>&1'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 4373ff1aa3..92169c789e 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-5"
-  postgres17: "17.6.1.132-pgcron-5"
-  postgres15: "15.14.1.132-pgcron-5"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-6"
+  postgres17: "17.6.1.132-pgcron-6"
+  postgres15: "15.14.1.132-pgcron-6"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

From cb969b789e35276cbe6bb9039d11bbbddfe574cb Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 20:18:36 -0400
Subject: [PATCH 10/17] fix: apply to both architecture

---
 amazon-amd64-nix.pkr.hcl |  4 +++-
 amazon-arm64-nix.pkr.hcl | 11 ++++++++++-
 ansible/vars.yml         |  6 +++---
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl
index 2630b992b7..051bbe3c39 100644
--- a/amazon-amd64-nix.pkr.hcl
+++ b/amazon-amd64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}} >/dev/null 2>&1'"
+    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
@@ -275,6 +275,8 @@ build {
 
   error-cleanup-provisioner "shell" {
     inline = [
+      "echo '===== /tmp/surrogate-bootstrap.log metadata (contents withheld) ====='",
+      "sudo test -f /tmp/surrogate-bootstrap.log && sudo stat --format='size_bytes=%s mode=%a owner=%U group=%G' /tmp/surrogate-bootstrap.log || echo 'surrogate bootstrap log not found'",
       "echo '===== /tmp/surrogate-diagnostic.log ====='",
       "sudo test -f /tmp/surrogate-diagnostic.log && sudo cat /tmp/surrogate-diagnostic.log || echo 'surrogate diagnostic log not found'"
     ]
diff --git a/amazon-arm64-nix.pkr.hcl b/amazon-arm64-nix.pkr.hcl
index a5faec3a93..762dd2f6e8 100644
--- a/amazon-arm64-nix.pkr.hcl
+++ b/amazon-arm64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
+    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
@@ -272,4 +272,13 @@ build {
     destination = "/tmp/ansible.log"
     direction = "download"
   }
+
+  error-cleanup-provisioner "shell" {
+    inline = [
+      "echo '===== /tmp/surrogate-bootstrap.log metadata (contents withheld) ====='",
+      "sudo test -f /tmp/surrogate-bootstrap.log && sudo stat --format='size_bytes=%s mode=%a owner=%U group=%G' /tmp/surrogate-bootstrap.log || echo 'surrogate bootstrap log not found'",
+      "echo '===== /tmp/surrogate-diagnostic.log ====='",
+      "sudo test -f /tmp/surrogate-diagnostic.log && sudo cat /tmp/surrogate-diagnostic.log || echo 'surrogate diagnostic log not found'"
+    ]
+  }
 }
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 92169c789e..9e6429157d 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-6"
-  postgres17: "17.6.1.132-pgcron-6"
-  postgres15: "15.14.1.132-pgcron-6"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-7"
+  postgres17: "17.6.1.132-pgcron-7"
+  postgres15: "15.14.1.132-pgcron-7"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

From 9e68cc1dcdb653fbb80980b993b4266adaf55f56 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 20:36:09 -0400
Subject: [PATCH 11/17] fix: permission

---
 amazon-amd64-nix.pkr.hcl | 2 +-
 amazon-arm64-nix.pkr.hcl | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl
index 051bbe3c39..4c7d8c9758 100644
--- a/amazon-amd64-nix.pkr.hcl
+++ b/amazon-amd64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
+    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}; status=$?; test ! -f /tmp/ansible.log || chown ubuntu:ubuntu /tmp/ansible.log; exit $status'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
diff --git a/amazon-arm64-nix.pkr.hcl b/amazon-arm64-nix.pkr.hcl
index 762dd2f6e8..696e540d59 100644
--- a/amazon-arm64-nix.pkr.hcl
+++ b/amazon-arm64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
+    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}; status=$?; test ! -f /tmp/ansible.log || chown ubuntu:ubuntu /tmp/ansible.log; exit $status'"
     start_retry_timeout = "5m"
     skip_clean = true
   }

From a297fc265e25e3e431302ee884f529ce5e629eea Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 20:36:39 -0400
Subject: [PATCH 12/17] chore: bump version

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 9e6429157d..87d7f8df02 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-7"
-  postgres17: "17.6.1.132-pgcron-7"
-  postgres15: "15.14.1.132-pgcron-7"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-8"
+  postgres17: "17.6.1.132-pgcron-8"
+  postgres15: "15.14.1.132-pgcron-8"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

From 12ebd57086b9baccbe8ede8035b0190eb9a0996c Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 20:55:17 -0400
Subject: [PATCH 13/17] fix: rollback diag and change runners

---
 amazon-amd64-nix.pkr.hcl                      | 11 +--------
 amazon-arm64-nix.pkr.hcl                      | 11 +--------
 ansible/vars.yml                              |  6 ++---
 .../scripts/surrogate-bootstrap-nix.sh        | 23 +++++++++----------
 4 files changed, 16 insertions(+), 35 deletions(-)

diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl
index 4c7d8c9758..4543955663 100644
--- a/amazon-amd64-nix.pkr.hcl
+++ b/amazon-amd64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}; status=$?; test ! -f /tmp/ansible.log || chown ubuntu:ubuntu /tmp/ansible.log; exit $status'"
+    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
@@ -272,13 +272,4 @@ build {
     destination = "/tmp/ansible.log"
     direction = "download"
   }
-
-  error-cleanup-provisioner "shell" {
-    inline = [
-      "echo '===== /tmp/surrogate-bootstrap.log metadata (contents withheld) ====='",
-      "sudo test -f /tmp/surrogate-bootstrap.log && sudo stat --format='size_bytes=%s mode=%a owner=%U group=%G' /tmp/surrogate-bootstrap.log || echo 'surrogate bootstrap log not found'",
-      "echo '===== /tmp/surrogate-diagnostic.log ====='",
-      "sudo test -f /tmp/surrogate-diagnostic.log && sudo cat /tmp/surrogate-diagnostic.log || echo 'surrogate diagnostic log not found'"
-    ]
-  }
 }
diff --git a/amazon-arm64-nix.pkr.hcl b/amazon-arm64-nix.pkr.hcl
index 696e540d59..a5faec3a93 100644
--- a/amazon-arm64-nix.pkr.hcl
+++ b/amazon-arm64-nix.pkr.hcl
@@ -262,7 +262,7 @@ build {
     ]
     use_env_var_file = true
     script = "ebssurrogate/scripts/surrogate-bootstrap-nix.sh"
-    execute_command = "sudo -S sh -c 'umask 077; exec >/tmp/surrogate-bootstrap.log 2>&1; . {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}; status=$?; test ! -f /tmp/ansible.log || chown ubuntu:ubuntu /tmp/ansible.log; exit $status'"
+    execute_command = "sudo -S sh -c '. {{.EnvVarFile}} && cd /tmp/ansible-playbook && {{.Path}}'"
     start_retry_timeout = "5m"
     skip_clean = true
   }
@@ -272,13 +272,4 @@ build {
     destination = "/tmp/ansible.log"
     direction = "download"
   }
-
-  error-cleanup-provisioner "shell" {
-    inline = [
-      "echo '===== /tmp/surrogate-bootstrap.log metadata (contents withheld) ====='",
-      "sudo test -f /tmp/surrogate-bootstrap.log && sudo stat --format='size_bytes=%s mode=%a owner=%U group=%G' /tmp/surrogate-bootstrap.log || echo 'surrogate bootstrap log not found'",
-      "echo '===== /tmp/surrogate-diagnostic.log ====='",
-      "sudo test -f /tmp/surrogate-diagnostic.log && sudo cat /tmp/surrogate-diagnostic.log || echo 'surrogate diagnostic log not found'"
-    ]
-  }
 }
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 87d7f8df02..1fafabe383 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-8"
-  postgres17: "17.6.1.132-pgcron-8"
-  postgres15: "15.14.1.132-pgcron-8"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-9"
+  postgres17: "17.6.1.132-pgcron-9"
+  postgres15: "15.14.1.132-pgcron-9"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index f078a66d9a..47f3014d13 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -7,7 +7,6 @@
 # Adapted from: https://github.com/jen20/packer-ubuntu-zfs
 
 set -o errexit
-set -o errtrace
 set -o pipefail
 set -o xtrace
 
@@ -440,17 +439,17 @@ function umount_reset_mappings {
 	done
 }
 
-run_step waitfor_boot_finished waitfor_boot_finished
-run_step install_packages install_packages
-run_step device_partition_mappings device_partition_mappings
-run_step format_and_mount_rootfs format_and_mount_rootfs
-run_step create_swapfile create_swapfile
-run_step format_build_partition format_build_partition
+waitfor_boot_finished
+install_packages
+device_partition_mappings
+format_and_mount_rootfs
+create_swapfile
+format_build_partition
 #pull_docker
-run_step setup_chroot_environment setup_chroot_environment
+setup_chroot_environment
 #download_ccache
-run_step execute_playbook execute_playbook
-run_step update_systemd_services update_systemd_services
+execute_playbook
+update_systemd_services
 #upload_ccache
-run_step clean_system clean_system
-run_step umount_reset_mappings umount_reset_mappings
+clean_system
+umount_reset_mappings

From e0f18932fcfcd984b1c42db82b7cee7ce06fa450 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Mon, 8 Jun 2026 21:13:54 -0400
Subject: [PATCH 14/17] fix: use blacksmith for arm

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 1fafabe383..4fbac11790 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-9"
-  postgres17: "17.6.1.132-pgcron-9"
-  postgres15: "15.14.1.132-pgcron-9"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-10"
+  postgres17: "17.6.1.132-pgcron-10"
+  postgres15: "15.14.1.132-pgcron-10"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

From 29b535386a20ae2fe6e32440db825c49ba76301a Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Tue, 9 Jun 2026 07:40:16 -0400
Subject: [PATCH 15/17] fix: different fallback

---
 ansible/vars.yml                                | 6 +++---
 ebssurrogate/scripts/surrogate-bootstrap-nix.sh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 4fbac11790..adeb3792ca 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-10"
-  postgres17: "17.6.1.132-pgcron-10"
-  postgres15: "15.14.1.132-pgcron-10"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-11"
+  postgres17: "17.6.1.132-pgcron-11"
+  postgres15: "15.14.1.132-pgcron-11"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index 47f3014d13..6d4c4b2497 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -273,7 +273,7 @@ EOF
 	if [ "${ARCH}" = "amd64" ]; then
 		debootstrap --arch ${ARCH} --variant=minbase "$UBUNTU_VERSION" /mnt "http://${REGION}.ec2.archive.ubuntu.com/ubuntu"
 	else
-		debootstrap --arch ${ARCH} --variant=minbase "$UBUNTU_VERSION" /mnt "http://${REGION}.clouds.ports.ubuntu.com/ubuntu-ports"
+		debootstrap --arch ${ARCH} --variant=minbase "$UBUNTU_VERSION" /mnt "http://ports.ubuntu.com/ubuntu-ports"
 	fi
 
 	sed -i "s/REGION/${REGION}/g" /tmp/sources.list

From fbadad3fde7896d9e3e96b45270e34878d2d77b8 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Fri, 12 Jun 2026 15:27:04 -0400
Subject: [PATCH 16/17] chore: bump to update

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index adeb3792ca..ed1da7c8f1 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-11"
-  postgres17: "17.6.1.132-pgcron-11"
-  postgres15: "15.14.1.132-pgcron-11"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-12"
+  postgres17: "17.6.1.132-pgcron-12"
+  postgres15: "15.14.1.132-pgcron-12"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1

From f27cb6164a5ec6083af1eb47503c72c6d25ff2b1 Mon Sep 17 00:00:00 2001
From: Sam Rose <samuel@supabase.io>
Date: Wed, 1 Jul 2026 13:52:55 -0400
Subject: [PATCH 17/17] chore: bump to test

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index ed1da7c8f1..0e554be618 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-12"
-  postgres17: "17.6.1.132-pgcron-12"
-  postgres15: "15.14.1.132-pgcron-12"
+  postgresorioledb-17: "17.6.0.089-orioledb-pgcron-13"
+  postgres17: "17.6.1.132-pgcron-13"
+  postgres15: "15.14.1.132-pgcron-13"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1