A database from the last release opens after a deploy: the migration ladder is proved against an old file with rows in it #80

Production follows main and keeps one SQLite file under FORGE_APP_DATA across deploys, so migrate() in src/db.ts is the only code in this app that runs against data it did not create. Nothing proves it: every test starts at freshData("name"), which is an empty directory, so open() builds today's SCHEMA and every addColumn finds its column already there. The ladder has grown to fourteen columns, five indexes and two backfill defaults (buyer_id, and actor_name/actor_role of 'unknown'), and a preview never exercises any of it because a preview's directory is empty too.

Done looks like

• [ ] src/db.test.ts (new, starting with await freshData("db")) builds a database in the shape of an earlier release — the tables without the columns the ladder adds — writes rows into it by hand (a guest order with items, a payment, a stock entry, an order event, a gift-card entry, a discount redemption), closes it, and then opens it with open().
• [ ] After that open: every row is still there and readable through the ordinary queries; the old order reads buyer_id === "" and so stays a guest order reached by its token; the five ledgers read actor_name === "unknown" and actor_role === "unknown"; the new indexes exist (PRAGMA index_list).
• [ ] open() on the same directory twice changes nothing — no duplicated column, no error, no rewritten row — and the second open is what a restart does.
• [ ] The old shape lives in the test as one string per table, not by mutating SCHEMA: the point is that a file written by code we no longer have still opens.
• [ ] /admin/audit renders the migrated rows without throwing — the page that reads all five ledgers is the one a missing column breaks.
• [ ] bun test --randomize stays green; the new file shares no directory with any other.

Files src/db.test.ts (new), src/db.ts only if a seam is needed to open a second directory (open is already exported), README.md where it describes the data directory.

Risks Do not weaken addColumn's guard or reorder the ladder — the order is the history. The fixture must not import today's SCHEMA, or the test proves nothing. Keep the fixture small: six tables of rows, not a copy of the seed.

Suggested ledger, with sentinel reading the pull — this is the one path where a mistake costs the shop's real rows.