Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction

plugins/printedparts/migrations/versions/0003_gagelabtag.py

@@ -3,6 +3,15 @@
 The gage lab issues WJRP asset numbers for printed parts; the internal
 itemcode stays auto-generated, and this optional unique tag carries the
 lab's number. The kiosk resolves scans/typed digits against both.
+
+Guarded/idempotent: skips when the table is absent (plugin disabled) or the
+column already exists (e.g. a test DB built by db.create_all() from the model).
+Unguarded, this failed `flask plugin upgrade-all` on any create-all-built
+database and took 0004 down with it, since a chain stops at its first error.
+
+The index is matched by COLUMN SET, not by name: create_all names indexes by
+SQLAlchemy's convention and this migration by the repo's, so a name-keyed guard
+would add a second index over the same column rather than skip.
 """
 from alembic import op
 import sqlalchemy as sa
@@ -15,13 +24,31 @@ branch_labels = None
 depends_on = None
 
 
+def _indexed(inspector):
+    return any(tuple(ix.get('column_names') or ()) == ('gagelabtag',)
+               for ix in inspector.get_indexes('printeditems'))
+
+
 def upgrade():
-    op.add_column('printeditems',
-                  sa.Column('gagelabtag', sa.String(length=50), nullable=True))
-    op.create_index('ix_printeditems_gagelabtag', 'printeditems',
-                    ['gagelabtag'], unique=True)
+    inspector = sa.inspect(op.get_bind())
+    if 'printeditems' not in inspector.get_table_names():
+        return
+    columns = {column['name'] for column in inspector.get_columns('printeditems')}
+    if 'gagelabtag' not in columns:
+        op.add_column('printeditems',
+                      sa.Column('gagelabtag', sa.String(length=50), nullable=True))
+    inspector = sa.inspect(op.get_bind())
+    if not _indexed(inspector):
+        op.create_index('ix_printeditems_gagelabtag', 'printeditems',
+                        ['gagelabtag'], unique=True)
 
 
 def downgrade():
-    op.drop_index('ix_printeditems_gagelabtag', table_name='printeditems')
-    op.drop_column('printeditems', 'gagelabtag')
+    inspector = sa.inspect(op.get_bind())
+    if 'printeditems' not in inspector.get_table_names():
+        return
+    if _indexed(inspector):
+        op.drop_index('ix_printeditems_gagelabtag', table_name='printeditems')
+    columns = {column['name'] for column in inspector.get_columns('printeditems')}
+    if 'gagelabtag' in columns:
+        op.drop_column('printeditems', 'gagelabtag')