chore(specs): interrupted or failed migrations must not be marked applied

[fclairamb]

Files one spec: specs/todos/2026-10-13-01-interrupted-migration-bricks-db.md (opus, high).

Stopping a container during its first start leaves a SQLite database that never starts again (no such column: organization.default_escalation_policy_uid). Cause: bun's migrator marks a migration applied before running it unless WithMarkAppliedOnSuccess(true) is set, and no migration is transactional. A migration that returns an error half way is recorded too, so the next boot skips it.

The spec proposes: mark-on-success for both backends, an atomic first boot for SQLite (build in a temp file, rename), a backup before pending migrations on an existing SQLite file, .tx.up.sql as the default for new migrations, and a clearer error for already-broken databases. Two open questions (backup, Postgres scope), each with a recommended answer.

Spec only, no code.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.08%. Comparing base (b74bf7c) to head (c2ebbf3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #548      +/-   ##
==========================================
- Coverage   83.08%   83.08%   -0.01%     
==========================================
  Files        1197     1197              
  Lines      123358   123358              
==========================================
- Hits       102488   102487       -1     
- Misses      20862    20863       +1     
  Partials        8        8              

see 19 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.