Check migration hygiene is red on main since the 1.3.0 forward-port, and blames every pre-existing PR for main's own ignored-series rename

bd main at 71c4cd08b999; observed 2026-09-16 on #6522 and #6571, reproduced locally.

Summary

Check migration hygiene is red on main itself since the release/1.3.0 forward-port, and it is red on every open PR whose recorded base predates that merge. Neither PR touches a migration; the check is blaming them for a rename main made.

What happened

b3d17caa6 (Merge release/1.3.0 into main, post-tag forward-port) carried a rename in the ignored series: internal/storage/schema/migrations/ignored/0026_add_wisps_current_revision.up.sql became 0027_… because 0026_dep_rekey_dedup_marker took its slot. Check C of scripts/check-migration-hygiene.sh ("shipped migrations are frozen") diffs --diff-filter=MDR from the merge-base of $BASE_SHA and HEAD over the migrations tree, and a rename of a file that existed on the base is exactly what it refuses.

Two consequences, one per workflow:

1. main.yml on the push of 71c4cd08b (run 35050349153, job Check migration hygiene): failure, with BASE_SHA = github.event.before. So main's own gate says the forward-port broke the frozen rule. Whether the ignored-series renumbering was legitimate is your call, but the gate currently says no.

2. pr.yml on every PR opened before the forward-port: BASE_SHA = github.event.pull_request.base.sha, which is the base tip as recorded on the PR, not the live tip of main. For #6522 that is f56632adc. git merge-base f56632adc <merge-ref> is f56632adc, so the diff to the merge ref includes main's own rename and check C fails with R077 …/0026_add_wisps_current_revision.up.sql → …/0027_…. The PR's diff contributes nothing to that. The Check doc flags freshness job two stanzas down already does this correctly (its comment: "merge-base and only fail PRs for drift they actually introduced").

Reproduction

git fetch origin refs/pull/6522/merge:refs/pr/6522-merge
git worktree add /tmp/m6522 refs/pr/6522-merge && cd /tmp/m6522
BASE_SHA=71c4cd08b999 ./scripts/check-migration-hygiene.sh   # Migration hygiene OK.
BASE_SHA=f56632adc    ./scripts/check-migration-hygiene.sh   # FAIL (frozen migrations) … R077 ignored/0026_add_wisps_current_revision → 0027_…

Same on #6571 (red); #6573 is green only because its last run predates the forward-port.

Suggested fix

• pr.yml: compute the base from the live base branch at run time, e.g. git fetch origin "$BASE_REF" and BASE_SHA=$(git rev-parse "origin/$BASE_REF"), or have the script take BASE_REF and do the merge-base itself, so a PR is judged only on drift it introduced. That is the doc-flags job's contract already.
• main: decide whether the ignored-series rename in b3d17caa6 is allowed. If the ignored series is exempt from freezing (it is the migrations that do not run), check C should exclude migrations/ignored/ and say so; if it is not exempt, the forward-port needs a follow-up that restores 0026_add_wisps_current_revision.up.sql and adds 0027 as a new file. Until one of those lands, main.yml stays red on that job for every push.

Happy to send the pr.yml half as a PR if you want it; the ignored-series question is the release owner's.