fix(migrations): adopt published ledgerless baseline

scripts/deploy-community.sh

@@ -146,6 +146,76 @@ create_backup() {
         | sort -nr | awk 'NR > 5 { print $2 }' | xargs -r rm -rf
 }
 
+validate_backup_migration() {
+    admin_image="$(env_value CRANK_ADMIN_API_IMAGE)"
+    if [ -z "$admin_image" ]; then
+        echo "CRANK_ADMIN_API_IMAGE is required for shadow migration validation" >&2
+        return 1
+    fi
+
+    shadow_id="crank-migration-check-$$"
+    shadow_network="${shadow_id}-network"
+    shadow_postgres="${shadow_id}-postgres"
+    shadow_password="crank-shadow-migration-password"
+    shadow_admin="crank_shadow_admin"
+    shadow_user="crank_shadow_owner"
+    shadow_cleanup() {
+        docker rm -fv "$shadow_postgres" >/dev/null 2>&1 || true
+        docker network rm "$shadow_network" >/dev/null 2>&1 || true
+    }
+    trap shadow_cleanup EXIT
+    trap 'exit 130' HUP INT TERM
+
+    docker network create "$shadow_network" >/dev/null
+    docker run -d --name "$shadow_postgres" --network "$shadow_network" \
+        -e POSTGRES_USER="$shadow_admin" \
+        -e POSTGRES_PASSWORD="$shadow_password" \
+        -e POSTGRES_DB=crank \
+        postgres:16-alpine >/dev/null
+
+    shadow_ready=false
+    attempt=1
+    while [ "$attempt" -le 30 ]; do
+        if docker logs "$shadow_postgres" 2>&1 | grep -q 'PostgreSQL init process complete' \
+            && docker exec "$shadow_postgres" pg_isready --username "$shadow_admin" --dbname crank >/dev/null 2>&1; then
+            shadow_ready=true
+            break
+        fi
+        sleep 1
+        attempt=$((attempt + 1))
+    done
+    if [ "$shadow_ready" != true ]; then
+        echo "Shadow PostgreSQL did not become ready" >&2
+        return 1
+    fi
+
+    docker exec "$shadow_postgres" psql --username "$shadow_admin" --dbname crank \
+        --set ON_ERROR_STOP=1 \
+        --command "create role ${shadow_user} login password '${shadow_password}' nosuperuser nocreatedb nocreaterole noreplication" \
+        --command "alter database crank owner to ${shadow_user}"
+
+    timeout 10m docker run --rm --network "$shadow_network" \
+        -e PGPASSWORD="$shadow_password" \
+        -v "$backup_dir:/backup:ro" \
+        postgres:16-alpine \
+        pg_restore --host "$shadow_postgres" --username "$shadow_user" --dbname crank \
+            --no-owner --no-privileges --single-transaction --exit-on-error \
+            /backup/postgres.dump
+
+    shadow_database_url="postgres://${shadow_user}:${shadow_password}@${shadow_postgres}:5432/crank"
+    timeout 10m docker run --rm --network "$shadow_network" \
+        -e CRANK_DATABASE_URL="$shadow_database_url" \
+        "$admin_image" crank-migrate apply
+    shadow_preflight="$(timeout 2m docker run --rm --network "$shadow_network" \
+        -e CRANK_DATABASE_URL="$shadow_database_url" \
+        "$admin_image" crank-migrate preflight)"
+    printf '%s\n' "$shadow_preflight" | grep -Fxq '{"status":"current","version":13}'
+
+    shadow_cleanup
+    trap - EXIT HUP INT TERM
+    echo "Shadow migration validation passed"
+}
+
 rollback() {
     echo "New release failed readiness; restoring previous deployment" >&2
     if [ ! -f .env.previous ] || [ ! -f docker-compose.previous.yml ]; then
@@ -168,6 +238,7 @@ rollback() {
 compose config -q
 create_backup
 compose pull
+validate_backup_migration
 
 if ! compose_up || ! wait_for_stack ready; then
     show_failure_diagnostics