## Problem Seven merged migrations tell the reader that an interrupted `Down` repairs itself. It does not. goose deletes the `goose_db_version` row only after every statement in the section has succeeded, and these files run under `-- +goose NO TRANSACTION`, so there is nothing to roll back. A `Down` killed partway leaves the migration still recorded as applied with the parent and some partitions already dropped. A later `Up` treats the version as applied and **skips the file** rather than rebuilding them, and the gap stays invisible until the first insert whose `namespace_id` hashes into a dropped remainder fails with `no partition of relation <table> found for row`. Re-running `Down` is what finishes the job. None of the seven comments say so, which leaves the reassuring reading available: that the migration repairs itself on the next deploy. `20260811120000_create_container_remote_blobs.sql` already carries the corrected wording. This issue is that same edit applied to the seven that shipped before it. ## Affected files Two separate comments carry the claim. All paths under `internal/datastore/migrations/sql/`. **A. Down-section body — `IF EXISTS on every DROP keeps the Down re-runnable after a mid-sequence interruption` (7 files)** 1. `20260723120200_create_npm_remote_metadata_files.sql` 1. `20260723120300_create_npm_remote_files.sql` 1. `20260724120000_create_namespace_encryption_keys.sql` 1. `20260804120000_create_container_remote_repositories.sql` 1. `20260805120000_create_maven_remote_files.sql` 1. `20260806120000_create_container_remote_images.sql` 1. `20260807130000_create_container_remote_manifests.sql` **B. `squawk-ignore-file prefer-robust-stmts` header — `a Down interrupted partway is replayable` (3 files, all already in list A)** - `20260804120000_create_container_remote_repositories.sql` - `20260806120000_create_container_remote_images.sql` - `20260807130000_create_container_remote_manifests.sql` Scope is exactly these seven. The three Maven remote migrations (`20260728120000_create_maven_remote_repositories.sql`, `20260730120000_create_maven_remote_packages.sql`, `20260731130000_create_maven_remote_versions.sql`) also use the word "replayable", but they say a partway `Down` is **not** replayable and spell out the accepted cost. That is the accurate form and needs no change. ## Target wording Match what `20260811120000_create_container_remote_blobs.sql` landed: - Header: `Every statement carries IF EXISTS, so re-running Down after an interruption finishes the job; see the Down section for why Up does not` - Body: `IF EXISTS on every DROP makes re-running Down safe after a mid-sequence interruption.`, followed by the `Re-run Down, not Up.` paragraph that explains the skipped-`Up` mechanism and names the table in the error string. ## This needs seven `Allow-Migration-Edit` trailers `lint:migration-immutability` fails on **any** modification to a migration already on the target branch — `scripts/ci/check-migration-immutability.sh` filters on `--diff-filter=MD` and requires the files stay byte-identical, so a comment-only edit is blocked exactly like a DDL rewrite. The documented exception is one trailer per file, on any commit of the branch, with the value beginning with the filename: ``` Allow-Migration-Edit: 20260723120200_create_npm_remote_metadata_files.sql comment-only: corrects the interrupted-Down claim ``` All seven need one. A trailer's free-text reason cannot authorise a second filename, and the parse only reads the structured trailer block, so the same string quoted in a commit body authorises nothing. See `docs/dev/database-migrations.md` ("Committed migrations are immutable"). ## Auditing this wording needs a comment-marker-stripped grep A plain grep finds only five of the seven. In two files the phrase wraps across a `--` comment continuation: - `20260806120000_create_container_remote_images.sql:321` - `20260807130000_create_container_remote_manifests.sql:364` Collapsing newlines alone does not find them either, because the `--` lands in the middle of the phrase. What works: ```shell for f in internal/datastore/migrations/sql/*.sql; do sed 's|^[[:space:]]*--[[:space:]]*||' "$f" | tr '\n' ' ' | tr -s ' ' \ | grep -q "re-runnable after a mid-sequence interruption" && echo "$f" done ``` Worth carrying into any future audit of migration comment wording, not just this one. ## Relationship to #448 Disjoint file sets, despite both being about a partway `Down`. [#448](https://gitlab.com/gitlab-org/ops/artifact-registry/-/issues/448) covers the 22 partitioned migrations whose `Down` is genuinely non-replayable because `DETACH PARTITION` takes no child `IF EXISTS` guard, and it also changes the shared `assertDownDropsEveryPartitionAndParent` helper. None of the seven files here contain a `DETACH PARTITION` statement — dropping `DETACH` is precisely why their `Down` sections can claim re-runnability at all. So the two can land in either order without touching the same lines. ## Proposed change 1. Apply the target wording above to the seven files (three of them in both places). 1. Carry one `Allow-Migration-Edit` trailer per file. 1. No DDL change, no `structure.sql` regeneration, no `knownHeadVersion` move. Surfaced in review of !1430 (S16 Step 2a, `container_remote_blobs` schema), which corrected its own wording and deferred the merged siblings rather than growing the diff.