fix(pg): let the below-marker backstop admit declared porting wrappers

The first Phase-4 prod migration was refused by checkPGBelowMarkerDrift:
prod's history has no rows for the two back-dated upstream migrations, and
the check runs before the goose Up that would execute their porting
wrapper. Local runs never hit this — fresh DBs seed history through the
marker.

PortedBelowMarker (declared next to the wrapper) maps each ported version
to its wrapper; the check now exempts a version whose wrapper is either
already applied or registered above the DB max (so the imminent goose Up
runs it). Anything else below the max still fails. The wrapper also records
the ported versions in goose history so steady state needs no exemption.

New TestPostgresPortBackdatedWrapper executes the wrapper's PG path against
a prod-shaped DB (DDL absent, history rows missing) — without it that path
would first run in production — plus exemption cases in the drift test.
Verified end-to-end: a DB reset to prod's exact pre-port state now runs
prepare db to completion (tables, vars, and history all land).

Claude-Session: https://claude.ai/code/session_01NrWVk8oMToieU6y3yDtYpY

Author: dnplkndll

server/datastore/mysql/migrations/tables/20260729190000_PortBackdatedUpstreamMigrations.go

@@ -9,6 +9,16 @@ func init() {
 	MigrationClient.AddMigration(Up_20260729190000, Down_20260729190000)
 }
 
+// PortedBelowMarker maps each back-dated upstream migration version to the
+// post-marker wrapper migration that ports its DDL on PG. The below-marker
+// drift backstop consults this so a deploy carrying the wrapper is allowed
+// through (the wrapper runs in the same goose Up); any other unapplied
+// below-marker version still fails the check.
+var PortedBelowMarker = map[int64]int64{
+	20260727083533: 20260729190000,
+	20260727084359: 20260729190000,
+}
+
 // Up_20260729190000 ports upstream migrations 20260727083533 (apple software
 // update assets + host OS update tracking) and 20260727084359 (host target OS
 // version fleet vars) to existing PostgreSQL databases. Both are numbered
@@ -63,6 +73,18 @@ func Up_20260729190000(tx *sql.Tx) error {
 			return err
 		}
 	}
+	// Record the ported versions in goose's history so the below-marker
+	// drift check is satisfied by real state on every later boot, not by
+	// the PortedBelowMarker exemption (which only needs to cover the boot
+	// that runs this wrapper).
+	for _, v := range []int64{20260727083533, 20260727084359} {
+		if _, err := tx.Exec(`
+	INSERT INTO migration_status_tables (version_id, is_applied)
+	SELECT ?, true
+	WHERE NOT EXISTS (SELECT 1 FROM migration_status_tables WHERE version_id = ?)`, v, v); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 

server/datastore/mysql/mysql.go

@@ -795,11 +795,27 @@ func (ds *Datastore) checkPGBelowMarkerDrift(ctx context.Context, marker int64)
 			dbMax = v
 		}
 	}
+	registered := make(map[int64]struct{}, len(tables.MigrationClient.Migrations))
+	for _, m := range tables.MigrationClient.Migrations {
+		registered[m.Version] = struct{}{}
+	}
 	var missing []int64
 	for _, m := range tables.MigrationClient.Migrations {
-		if _, ok := appliedSet[m.Version]; !ok && m.Version < dbMax {
-			missing = append(missing, m.Version)
+		if _, ok := appliedSet[m.Version]; ok || m.Version >= dbMax {
+			continue
+		}
+		// A back-dated migration with a declared porting wrapper is not
+		// drift when that wrapper already ran, or is registered above the
+		// DB's max version so the goose Up following this check runs it.
+		if wrapper, ok := tables.PortedBelowMarker[m.Version]; ok {
+			if _, done := appliedSet[wrapper]; done {
+				continue
+			}
+			if _, reg := registered[wrapper]; reg && wrapper > dbMax {
+				continue
+			}
 		}
+		missing = append(missing, m.Version)
 	}
 	if len(missing) == 0 {
 		return nil

server/datastore/mysql/postgres_smoke_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql/migrations/tables"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -667,6 +668,72 @@ func TestPostgresBelowMarkerDriftCheck(t *testing.T) {
 	err = ds.checkPGBelowMarkerDrift(ctx, marker)
 	require.Error(t, err, "missing below-marker record must error")
 	require.Contains(t, err.Error(), "PG migration drift")
+	_, err = ds.primary.Exec(`INSERT INTO migration_status_tables (version_id, is_applied) VALUES ($1, true)`, victim)
+	require.NoError(t, err)
+
+	// Back-dated versions with a declared porting wrapper are exempt — both
+	// when the wrapper is already applied (steady state after the port ran)…
+	require.NotEmpty(t, tables.PortedBelowMarker)
+	var wrapper int64
+	for ported, w := range tables.PortedBelowMarker {
+		wrapper = w
+		_, err = ds.primary.Exec(`DELETE FROM migration_status_tables WHERE version_id = $1`, ported)
+		require.NoError(t, err)
+	}
+	require.NoError(t, ds.checkPGBelowMarkerDrift(ctx, marker),
+		"ported back-dated versions with an applied wrapper are not drift")
+
+	// …and when the wrapper is itself pending above the DB max (the boot
+	// that is about to run it — the exact state of the first Phase-4 prod
+	// deploy, which the check aborted before this exemption existed).
+	_, err = ds.primary.Exec(`DELETE FROM migration_status_tables WHERE version_id = $1`, wrapper)
+	require.NoError(t, err)
+	require.NoError(t, ds.checkPGBelowMarkerDrift(ctx, marker),
+		"ported back-dated versions with a pending goose-reachable wrapper are not drift")
+}
+
+// TestPostgresPortBackdatedWrapper executes Up_20260729190000's PG path
+// directly against a database shaped like prod before the port ran: the
+// back-dated upstream DDL absent and no history rows for the ported versions.
+// Fresh test DBs seed the wrapper as applied (its effects are in the
+// baseline), so without this test the wrapper's real code path would only
+// ever run for the first time in production.
+func TestPostgresPortBackdatedWrapper(t *testing.T) {
+	ds := CreatePostgresDS(t)
+
+	mustExec := func(q string, args ...interface{}) {
+		_, err := ds.primary.Exec(q, args...)
+		require.NoError(t, err, q)
+	}
+	mustExec(`DROP TABLE IF EXISTS apple_software_update_assets CASCADE`)
+	mustExec(`DROP TABLE IF EXISTS host_mdm_apple_os_updates CASCADE`)
+	mustExec(`DELETE FROM fleet_variables WHERE name LIKE 'FLEET_VAR_HOST_TARGET%'`)
+	for ported := range tables.PortedBelowMarker {
+		mustExec(`DELETE FROM migration_status_tables WHERE version_id = $1`, ported)
+	}
+
+	runWrapper := func() {
+		tx, err := ds.primary.DB.Begin()
+		require.NoError(t, err)
+		require.NoError(t, tables.Up_20260729190000(tx))
+		require.NoError(t, tx.Commit())
+	}
+	runWrapper()
+
+	var n int
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM apple_software_update_assets`))
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM host_mdm_apple_os_updates`))
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM fleet_variables WHERE name LIKE 'FLEET_VAR_HOST_TARGET%'`))
+	require.Equal(t, 2, n, "both fleet vars inserted")
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM migration_status_tables WHERE version_id IN (20260727083533, 20260727084359) AND is_applied`))
+	require.Equal(t, 2, n, "ported versions recorded in goose history")
+
+	// Idempotent: a re-run must not duplicate vars or history rows.
+	runWrapper()
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM fleet_variables WHERE name LIKE 'FLEET_VAR_HOST_TARGET%'`))
+	require.Equal(t, 2, n)
+	require.NoError(t, ds.primary.Get(&n, `SELECT COUNT(*) FROM migration_status_tables WHERE version_id IN (20260727083533, 20260727084359)`))
+	require.Equal(t, 2, n)
 }
 
 // TestPostgresDBDiagnostics regression-covers DBLocks and InnoDBStatus on PG: