feat(database): reserve an ordinal band for package migrations, and defend it

[glennmichael123]

Guard rails ahead of the change that needs them. Nothing stages package migrations yet. These are the four places that would renumber or delete a staged file the moment one existed.

Landing them first is deliberate: installing them afterwards means shipping a window in which an application's own generator can delete a package's schema.

Why a reserved band and not max + 1

Migrations run in readdirSync().sort() order, so the leading ordinal is the run order. A package's tables carry foreign keys into the application's (user_id, team_id) and never the reverse, because the app predates whatever it installed. A REFERENCES "users" on a table created before users fails on Postgres and MySQL while SQLite tolerates it, so getting this wrong is green locally and red on deploy.

Three ordinal computations would invert the order under max + 1:

	what it would do
nextMigrationNumber	maxes over every file, so one staged file drags every future app migration into the band behind it
historicalBoundary	takes the max among unmarked files, and a staged file is unmarked, so migrate:regenerate numbers the regenerated app corpus above the package's
startAt	falls back to the max among preserved files, same result by another route

And two that delete rather than renumber

• preprocessSqliteMigrations prunes duplicate create-tables by keeping the earliest filename and deleteMigration()-ing the rest. A package's ordinal is high by construction, so it loses that comparison against anything the generator emitted for the same table.
• regenerateMigrationCorpus sets deletable = existing under replaceUnmarked or onlyExistingTables, ignoring markers entirely. Package files are excluded from the deletable set rather than rescued afterwards, so no later filter can put them back.

The band is ten digits so lexicographic and numeric order agree, which is the property the whole scheme rests on. There is a test pinning it, and one pinning that a filename with no ordinal is never mistaken for a package's and made undeletable.

Verification

• 5 new tests
• core/database: 880 pass, 1 fail; that failure is on clean main too
• root suite: 402 pass, 0 fail
• framework typecheck: 4 errors, all pre-existing @stacksjs/tlsx
• ./buddy lint clean apart from the pre-existing untracked storage/framework/libs/entries/

All four guards are no-ops on a corpus with no band files, which is every corpus today.

🤖 Generated with Claude Code