Pin Nucleus v1.2.1 (upstream fix for the L9 ALTER corruption)

.github/workflows/ci.yml

@@ -14,6 +14,11 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The engine version CI tests against and production runs (teploy.yml pins
+# the same tag; docker-compose.yml defaults to it). One place to bump.
+env:
+  NUCLEUS_VERSION: v1.2.1
+
 # This repo embeds the built UI at cmd/observe/ui/dist/ as part of the
 # repo (single-binary story). CI only needs to build + test the Go code
 # — no pnpm, no Rust toolchain, no Nucleus build. Local devs run
@@ -175,7 +180,7 @@ jobs:
   # 027) was fixed upstream on 2026-09-18 (Neutron 6286531a) and
   # repo-built engines pass the full migration ladder again — the
   # lease-capability job below builds from the pin and relies on it. This
-  # Supported-release coverage now uses v1.1.1 on both architectures.
+  # Supported-release coverage uses NUCLEUS_VERSION on both architectures.
   # v0.1.8 no longer satisfies the full suite (leases, parameterized paging,
   # and committed upserts); its failing run is recorded in AUDIT_OPEN.md.
   # X01: the vendor/ tree is what actually compiles, but go.mod's replace
@@ -214,7 +219,8 @@ jobs:
           fi
 
   # X01 compatibility matrix: the same suite against the engine version
-  # production actually runs (v1.1.1) on arm64. This combination found two
+  # production actually runs (NUCLEUS_VERSION, kept in sync with teploy.yml)
+  # on arm64. This combination found two
   # real defects the v0.1.8 job structurally cannot see (the version-tie
   # ambiguity — fast native runs collide at millisecond granularity while
   # slower CI engines never do — and the v0.1.8 arm64 image is broken
@@ -227,13 +233,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.25'
-      - name: Start pinned Nucleus v1.1.1
+      - name: Start pinned Nucleus
         run: |
           docker run -d --name nucleus -p 55432:5432 \
             -e NUCLEUS_ALLOW_NO_AUTH=1 \
             -e NUCLEUS_ALLOW_INSECURE_CLUSTER=1 \
             -e NUCLEUS_ALLOW_INSECURE_REPLICATION=1 \
-            ghcr.io/neutron-build/nucleus:v1.1.1 \
+            ghcr.io/neutron-build/nucleus:${{ env.NUCLEUS_VERSION }} \
             start --host 0.0.0.0 --port 5432 --cluster-port 5433 --data /data --max-memory 512
           for i in $(seq 1 60); do
             if (exec 3<>/dev/tcp/127.0.0.1/55432) 2>/dev/null; then exec 3>&-; exit 0; fi
@@ -261,7 +267,7 @@ jobs:
           echo "observe did not become healthy" >&2
           kill "$OBS_PID" 2>/dev/null || true
           exit 1
-      - name: Full suite against live Nucleus v1.1.1
+      - name: Full suite against pinned Nucleus
         env:
           OBSERVE_NUCLEUS_URL: postgres://nucleus@127.0.0.1:55432/observe?sslmode=disable
           OBSERVE_REQUIRE_NUCLEUS: "1"
@@ -281,7 +287,7 @@ jobs:
             -e NUCLEUS_ALLOW_NO_AUTH=1 \
             -e NUCLEUS_ALLOW_INSECURE_CLUSTER=1 \
             -e NUCLEUS_ALLOW_INSECURE_REPLICATION=1 \
-            ghcr.io/neutron-build/nucleus:v1.1.1 \
+            ghcr.io/neutron-build/nucleus:${{ env.NUCLEUS_VERSION }} \
             start --host 0.0.0.0 --port 5432 --cluster-port 5433 --data /data --max-memory 512
           for i in $(seq 1 60); do
             if (exec 3<>/dev/tcp/127.0.0.1/55432) 2>/dev/null; then exec 3>&-; exit 0; fi

AUDIT_OPEN.md

@@ -46,6 +46,19 @@ regenerable LLM traces - owner call), (b) whether new ALTER-ADD migrations
 should be refused by a test, and (c) a migration test against a populated,
 upgraded store rather than a fresh one.
 
+Upstream resolution (2026-10-04): the engine defect is fixed in Nucleus
+v1.2.1 (atomic ALTER rewrites; half-applied ALTERs no longer recorded as
+applied; a new engine-side refusal rejects ALTERs that follow writes to the
+same table in one transaction). This repo pins v1.2.1 in teploy.yml, CI
+(NUCLEUS_VERSION) and docker-compose; observe's full suite plus a fresh
+migration boot verified against that image. Re-scoped: (b) is no longer
+needed for correctness on v1.2.1+ — the engine itself enforces the unsafe
+ordering; (c) is satisfied by `TestMigrationsUpgradePopulatedStore` on the
+S1 branch; (a) remains open as an owner op and now has an in-place path
+(the `catalog.json` repair in Neutron's
+`nucleus/docs/HANDOVER_TEPLOY_OBSERVE_ADD_COLUMN.md`) that preserves the
+rows instead of losing regenerable traces.
+
 ## Round-4 register (2026-09-19 audit, 45 findings R01..R45)
 
 Audited revision `5e2108d`. Every finding was verified against local source

docker-compose.yml

@@ -39,7 +39,9 @@
 
 services:
   nucleus:
-    image: ghcr.io/neutron-build/nucleus:latest
+    # Pinned (was :latest). Keep in sync with NUCLEUS_VERSION in
+    # .github/workflows/ci.yml; override with NUCLEUS_VERSION=... to upgrade.
+    image: ghcr.io/neutron-build/nucleus:${NUCLEUS_VERSION:-v1.2.1}
     restart: unless-stopped
     networks:
       # R43 (round 4): database on the internal backend network only — the

teploy.yml

@@ -111,7 +111,23 @@ accessories:
     # v1.1.0's arm64 layer was built with a drifting cross toolchain (needed
     # GLIBC_2.38); v1.1.1 pins cross 0.2.5 and loads on bookworm. Verified:
     # observe's full suite (44 packages, -p 1) green against the v1.1.x image.
-    image: ghcr.io/neutron-build/nucleus:v1.1.1
+    #
+    # v1.2.1 (2026-10-04), up from v1.1.1. Atomic ALTER rewrites: ADD/DROP
+    # COLUMN and ALTER COLUMN TYPE now adopt the new layout, rewrite every
+    # row, rebuild the indexes and verify every tuple decodes as one
+    # all-or-nothing step; any failure restores the pre-change state. Fixes
+    # the L9 live-store corruption (llm_traces undecodable after several
+    # in-transaction ALTER ADDs; half-applied ALTERs recorded as migrated —
+    # the token_source-yes/cost_source-no state on infra-home). The live
+    # store still needs the in-place catalog repair from
+    # Neutron's nucleus/docs/HANDOVER_TEPLOY_OBSERVE_ADD_COLUMN.md before
+    # migration 054 can re-run. New refusal to respect in migration files:
+    # ALTER on a table this transaction has already written to errors —
+    # order ALTERs before DML. CREATE UNIQUE INDEX now enforces uniqueness
+    # on populated tables. Verified: observe's full suite (48 packages,
+    # -p 1) green against the v1.2.1 image, plus a fresh migration boot
+    # (001-056).
+    image: ghcr.io/neutron-build/nucleus:v1.2.1
     port: 5432
     # Hard cgroup cap, and the only bound the kernel enforces.
     # NUCLEUS_MAX_MEMORY_MB below is the engine's accounting of its OWN