mrhid6
0b7e55d301
Two failures found by tracing the migration path against a real upgrade. Bootstrap orphaned the entire dataset. On upgrade, 0001 creates the Default org and stamps every legacy document with it, but the instance has no users, so the operator must run /auth/bootstrap to get in — and that unconditionally created a SECOND org and put the owner in it. Every org-scoped read then filtered on the new org, so the operator would log into an empty Vantage while all their data sat under "default". Nothing errored and agents kept syncing, so it presented as total data loss. Bootstrap now adopts the sole existing org, renaming and re-slugging it, and only creates one when no org exists. More than one org with no users is refused rather than guessed. Fresh installs crash-looped. Nothing creates the settings collection before EnsureSettingsIndexes, so DropOne returned NamespaceNotFound (26), isIndexNotFound matched only IndexNotFound (27), and that check is fatal. The same early return also skipped index creation in the secrets and workflow ensures. Also: only insert the backfill org on ErrNoDocuments, so a transient read error can't race the fatal unique slug index; run 0002 before 0003 so the settings migration can't be pushed into its ambiguous branch; fail 0002's ambiguous case with a remedy instead of continuing into a fatal index build; and skip non-string ids in the owner backfill rather than aborting.