# Production migration ledger reconciliation

Status: completed on 2026-07-12; production ledger/schema reconciled idempotently through 0069.

## Incident

Production Neon project `purple-haze-75517629` records migrations only through local `0046`, while the schema contains unledgered `0047`–`0062` objects. `0063`–`0066` are absent, `0068` is partially present, and `0069_shell_layouts` is absent. Backdated journal timestamps on `0050` and `0058` make index-based assumptions unsafe.

## Tool

Run from `packages/db`. The command is dry-run unless `--apply` is present. `DATABASE_URL` and a human-readable `--target=<project/branch>` are mandatory. Every run writes a new evidence manifest and refuses to overwrite one.

```bash
DATABASE_URL='<explicit Neon clone URL>' pnpm tsx scripts/reconcile-production-migrations.ts \
  --target='purple-haze-75517629/reconcile-rehearsal' \
  --manifest='./reconciliation-rehearsal-dry-run.json'
```

Review the manifest, then apply on the clone without `--apply-0069`:

```bash
DATABASE_URL='<same clone URL>' pnpm tsx scripts/reconcile-production-migrations.ts \
  --target='purple-haze-75517629/reconcile-rehearsal' --apply \
  --manifest='./reconciliation-rehearsal-apply.json'
```

After independent schema and manifest review, rerun idempotently with `--apply --apply-0069` and a new manifest path. This permits the canonical migration runner to apply `0069`; it does not rewrite migration history.

## Gates

- Create a Neon branch from production immediately before rehearsal and retain its branch ID in the change record.
- Dry-run manifest must show only the twelve expected ledger inserts and explicit `0068` execute/skip decisions.
- Any canonical hash, timestamp, postcondition, unsupported statement, or snapshot-shape mismatch aborts.
- `0068` missing statements execute verbatim from the canonical generated SQL within one transaction. The canonical ledger row is inserted only after snapshot equivalence.
- Verify ledger count, table/column/constraint/index inventory, and application smoke tests on the clone before requesting production authority.
- Production received a fresh backup branch immediately before apply. Evidence manifests for the rehearsal, dry-run, apply, and post-0069 assertions are committed under `docs/plans/audit/zync-os-functional-recovery/`. Never reuse clone credentials or manifests. Durable follow-up: retain the backup branch and rerun the dry-run manifest after the next migration batch; any unexpected ledger or schema drift blocks that batch.