fix(deploy): distinguish core migration drift

crates/crank-registry/src/migrations/authority.rs

@@ -410,7 +410,7 @@ async fn inspect(connection: &mut PgConnection) -> Result<MigrationPreflight, Mi
         if owned_exists {
             return Err(MigrationError::new(
                 "partial_sequence",
-                "preflight.core",
+                "preflight.core_missing",
                 None,
                 "restore_known_good_backup",
             ));
@@ -549,7 +549,7 @@ async fn validate_core_ledger(connection: &mut PgConnection) -> Result<(), Migra
     if rows.len() != 1 {
         return Err(MigrationError::new(
             "partial_sequence",
-            "preflight.core",
+            "preflight.core_cardinality",
             None,
             "restore_known_good_backup",
         ));

crates/crank-registry/tests/integration/migrations.rs

@@ -937,6 +937,20 @@ async fn any_owned_relation_without_core_ledger_is_partial() {
         .unwrap();
     let error = MigrationAuthority::preflight(&pool).await.unwrap_err();
     assert_eq!(error.code(), "partial_sequence");
+    assert_eq!(error.stage(), "preflight.core_missing");
+}
+#[tokio::test]
+async fn empty_core_ledger_is_reported_separately() {
+    let database_url = crank_test_support::postgres_schema_url("test_empty_core_ledger").await;
+    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
+    MigrationAuthority::apply(&pool).await.unwrap();
+    sqlx::query("delete from __crank_core_migrations")
+        .execute(&pool)
+        .await
+        .unwrap();
+    let error = MigrationAuthority::preflight(&pool).await.unwrap_err();
+    assert_eq!(error.code(), "partial_sequence");
+    assert_eq!(error.stage(), "preflight.core_cardinality");
 }
 #[tokio::test]
 async fn current_ledger_with_structural_drift_fails_closed() {

scripts/restore-community.sh

@@ -49,13 +49,18 @@ postgres_port="$(env_value POSTGRES_PORT 5432)"
 postgres_db="$(env_value POSTGRES_DB crank)"
 postgres_user="$(env_value POSTGRES_USER crank)"
 postgres_password="$(env_value POSTGRES_PASSWORD)"
+docker run --rm \
+    -v "$backup_dir:/backup:ro" \
+    postgres:16-alpine \
+    pg_restore --list /backup/postgres.dump >/dev/null
 docker run --rm --network host \
     -e PGPASSWORD="$postgres_password" \
     -v "$backup_dir:/backup:ro" \
     postgres:16-alpine \
     pg_restore --host "$postgres_host" --port "$postgres_port" \
         --username "$postgres_user" --dbname "$postgres_db" \
-        --clean --if-exists --no-owner --no-privileges /backup/postgres.dump
+        --clean --if-exists --no-owner --no-privileges \
+        --single-transaction --exit-on-error /backup/postgres.dump
 
 admin_container="$(compose ps -aq admin-api)"
 storage_root="$(env_value CRANK_STORAGE_ROOT /var/lib/crank/storage)"