svcforge/migrations/003_day2.sql

-- 003_day2.sql — the whole of day 2: two columns and one query.
--
-- Forward-only, expand/contract. Both additions are nullable / defaulted, so the old
-- code keeps running against the new schema between the migrate and the deploy. That
-- ordering is not optional: migrate first, deploy second, and a column the running
-- code has never heard of must not break it.

alter table instances add column maintenance_window text;   -- '0 3 * * 0|Asia/Ho_Chi_Minh', null = any time

-- One row per service type, one column that matters. `halted` is what stops a bad
-- chart after the first tenant instead of after all of them, and it is cleared by
-- hand with SQL — an automatic un-halt would just resume breaking things.
create table catalog_versions (
  service_type  text primary key,
  rollout_state text not null default 'ok'    -- 'ok' | 'halted'
);