fix(db): make column migrations atomic

Column migrations may pair schema changes with one-time data backfills. If startup fails between those statements, detecting only column existence can suppress the repair permanently. Commit the batch atomically so failed opens leave the schema retryable.

Author: wesm

internal/db/db.go

@@ -2146,11 +2146,26 @@ func schemaColumnMigrations() []schemaColumnMigration {
 	}
 }
 
-func applySchemaColumnMigrations(
-	queryRow func(string, ...any) rowScanner,
-	exec func(string, ...any) (sql.Result, error),
-) error {
-	return applyColumnMigrations(schemaColumnMigrations(), queryRow, exec)
+func applySchemaColumnMigrations(w *writerHandle) error {
+	tx, err := w.BeginTx(context.Background(), nil)
+	if err != nil {
+		return fmt.Errorf("starting column migration transaction: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if err := applyColumnMigrations(
+		schemaColumnMigrations(),
+		func(query string, args ...any) rowScanner {
+			return tx.QueryRow(query, args...)
+		},
+		tx.Exec,
+	); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("committing column migrations: %w", err)
+	}
+	return nil
 }
 
 func applyColumnMigrations(
@@ -2396,7 +2411,7 @@ func (db *DB) migrateColumns() error {
 	if _, err := w.Exec(artifactSessionQueueTriggerDropsSQL); err != nil {
 		return fmt.Errorf("dropping artifact session queue triggers: %w", err)
 	}
-	if err := applySchemaColumnMigrations(w.QueryRow, w.Exec); err != nil {
+	if err := applySchemaColumnMigrations(w); err != nil {
 		return err
 	}
 	if _, err := w.Exec(artifactSessionQueueTriggerCreatesSQL); err != nil {

internal/db/legacy_schema_test.go

@@ -261,6 +261,62 @@ func TestParserParentSessionIDMigrationBackfillsCurrentParent(t *testing.T) {
 	assert.Equal(t, "parsed-parent", got.String, "migrated parser parent")
 }
 
+func TestParserParentSessionIDMigrationRollsBackWhenBackfillFails(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "legacy.db")
+	conn, err := sql.Open("sqlite3", makeDSN(path, false))
+	require.NoError(t, err)
+	conn.SetMaxOpenConns(1)
+
+	_, err = conn.Exec(v06LegacySchema)
+	require.NoError(t, err, "create legacy schema")
+	_, err = conn.Exec(`
+		INSERT INTO sessions (
+			id, project, machine, agent, parent_session_id
+		) VALUES (
+			'kid', 'project-a', 'local', 'claude', 'parsed-parent'
+		);
+		CREATE TRIGGER fail_parser_parent_backfill
+		BEFORE UPDATE OF parser_parent_session_id ON sessions BEGIN
+			SELECT RAISE(ABORT, 'injected parser parent backfill failure');
+		END;`)
+	require.NoError(t, err, "prepare failing legacy migration")
+	_, err = conn.Exec(fmt.Sprintf(
+		"PRAGMA user_version = %d", dataVersion,
+	))
+	require.NoError(t, err, "set current data version")
+	require.NoError(t, conn.Close(), "close legacy database")
+
+	d, err := Open(path)
+	require.ErrorContains(t, err, "injected parser parent backfill failure")
+	require.Nil(t, d)
+
+	conn, err = sql.Open("sqlite3", makeDSN(path, false))
+	require.NoError(t, err, "reopen failed migration")
+	conn.SetMaxOpenConns(1)
+	var columnCount int
+	err = conn.QueryRow(`
+		SELECT count(*) FROM pragma_table_info('sessions')
+		WHERE name = 'parser_parent_session_id'
+	`).Scan(&columnCount)
+	require.NoError(t, err, "inspect schema after failed migration")
+	assert.Zero(t, columnCount, "failed migration must roll back added column")
+	_, err = conn.Exec(`DROP TRIGGER fail_parser_parent_backfill`)
+	require.NoError(t, err, "remove injected migration failure")
+	require.NoError(t, conn.Close(), "close failed migration database")
+
+	d, err = Open(path)
+	require.NoError(t, err, "retry migration")
+	defer d.Close()
+
+	var got sql.NullString
+	err = d.getReader().QueryRow(`
+		SELECT parser_parent_session_id FROM sessions WHERE id = 'kid'
+	`).Scan(&got)
+	require.NoError(t, err, "query retried parser parent")
+	require.True(t, got.Valid, "retried parser parent must be set")
+	assert.Equal(t, "parsed-parent", got.String, "retried parser parent")
+}
+
 func TestLegacySchemaAddsArtifactImportAuthorityNonDestructively(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "legacy.db")
 	conn, err := sql.Open("sqlite3", makeDSN(path, false))