- fresh database, legacy upgrade (rows get one-shot access key, online=false), repeat startup idempotence - 1058 revised before any database applied it: drop dead token column, provision access_key via temporary default so non-empty legacy tables upgrade - immutable-migration rule skips PR-local migrations until merged; after merge the lock applies again