From 08f52d3f1cedd5d8314b409278353866b80af0fd Mon Sep 17 00:00:00 2001
From: dev_agent <dev_agent@cubecraftlabs.com>
Date: Wed, 7 Oct 2026 18:12:30 -0400
Subject: [PATCH] Make the rollback migration check fail fast and keep its
 status

Run the check in a set -eu subshell so a failed cd, copy, git ls-tree
or comparison stops it before any verdict is printed, and remove the
scratch directory from an EXIT trap that preserves the check's status.
Spell out the reading rule: none, listed versions, or stop on error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 deploy/RUNBOOK.md | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/deploy/RUNBOOK.md b/deploy/RUNBOOK.md
index fe8278c..ba95f3f 100644
--- a/deploy/RUNBOOK.md
+++ b/deploy/RUNBOOK.md
@@ -576,11 +576,15 @@ of its own migration files — the `*.sql` files directly in `migrations/`
 versions the live database has applied with the files the previous SHA has:
 
 ```sh
-cd /home/overseer/mealquest
+cd /home/overseer/mealquest && (
+set -eu   # any failed step ends the check with a nonzero status
 D=/var/lib/docker/volumes/mealquest-data/_data
 P=<previous SHA>
-rm -rf /tmp/mqcheck && mkdir /tmp/mqcheck
-sudo sh -c "cp -a $D/mealquest.db* /tmp/mqcheck/" && sudo chown -R "$USER" /tmp/mqcheck
+rm -rf /tmp/mqcheck
+mkdir /tmp/mqcheck
+trap 'st=$?; rm -rf /tmp/mqcheck; [ "$st" -eq 0 ] || echo "check FAILED (status $st): stop and fix the cause" >&2; exit "$st"' EXIT
+sudo sh -c "cp -a $D/mealquest.db* /tmp/mqcheck/"
+sudo chown -R "$USER" /tmp/mqcheck
 git ls-tree --name-only "$P" migrations/ > /tmp/mqcheck/known   # top level only
 python3 - /tmp/mqcheck/mealquest.db /tmp/mqcheck/known <<'PY'
 import sqlite3, sys
@@ -591,13 +595,20 @@ if not applied or not known:
 unknown = sorted(applied - known)
 print("unknown to the previous SHA:", " ".join(unknown) if unknown else "none")
 PY
-rm -rf /tmp/mqcheck
+)
 ```
 
-It prints `none` when no migration crossed; otherwise it lists the versions
-the older build does not know, and the migration-crossing path below is
-required. If it exits with an error, stop and fix the cause — do not pick a
-path.
+The check runs in a subshell that stops at the first failed step — the
+copy, `git ls-tree` or the comparison — and removes `/tmp/mqcheck` on the
+way out without changing the status. Read it like this:
+
+- `unknown to the previous SHA: none` and `echo $?` prints `0` — no
+  migration crossed: take the plain restart below.
+- `unknown to the previous SHA:` followed by versions, and `echo $?`
+  prints `0` — the older build does not know them: the migration-crossing
+  path below is required.
+- `check FAILED`, any other error, or a nonzero `echo $?` — stop and fix
+  the cause, then run the check again. Do not pick a path.
 
 **No migration crossed** — rebuild and restart the older SHA: