fix(gate-b): fresh-db install path - conditional guards on plugin-table migrations + dual-path convergence migrations

alembic/versions/0136_fix_rls_tenant_id.py

@@ -10,6 +10,7 @@ Revises: 0135
 Create Date: 2026-08-21
 """
 from alembic import op
+import sqlalchemy as sa
 
 revision = "0136"
 down_revision = "0135"
@@ -29,8 +30,25 @@ TABLES_WITH_BAD_RLS = [
 ]
 
 
+def _table_exists(conn, table_name: str) -> bool:
+    """True when the table exists (dual-path convergence, Gate B).
+
+    Plugin-owned tables may not exist yet on a fresh install when Alembic
+    reaches this revision — skip them instead of failing. The plugin-side
+    convergence migrations apply the same RLS policies.
+    """
+    row = conn.execute(
+        sa.text("SELECT to_regclass(:tname) IS NOT NULL"),
+        {"tname": f"public.{table_name}"},
+    ).scalar()
+    return bool(row)
+
+
 def upgrade() -> None:
+    conn = op.get_bind()
     for table in TABLES_WITH_BAD_RLS:
+        if not _table_exists(conn, table):
+            continue
         # Drop old policy with app.tenant_id
         op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
         # Create new policy with app.current_tenant_id
@@ -41,7 +59,10 @@ def upgrade() -> None:
 
 
 def downgrade() -> None:
+    conn = op.get_bind()
     for table in TABLES_WITH_BAD_RLS:
+        if not _table_exists(conn, table):
+            continue
         op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
         op.execute(
             f"CREATE POLICY tenant_isolation ON {table} "