Repair broken and flaky tests exposed by live-Postgres and load runs

- RebuildNodes tests staged a stale tsv via UPDATE, but the BEFORE
  UPDATE trigger recomputed tsv from content and erased the stale state,
  failing both tests against a real Postgres. Disable the trigger during
  staging so RebuildNodes' own SQL is what gets verified.
- The rapid-push dedup test raced three Adds against an already-running
  worker and flaked under parallel load. Hold the single worker with a
  gated blocker repo so all pushes deterministically arrive while queued.
- main_postgres_test referenced migrateSchemaVersion, a type renamed to
  migration.MigrationSchemaVersion; the postgres-tagged file no longer
  compiled (unnoticed because CI never builds that tag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tae2089

cmd/ccg/main_postgres_test.go

@@ -157,7 +157,7 @@ func TestRunMigrations_PostgresDownRestoresNullableColumns(t *testing.T) {
 		t.Fatalf("run down migration: %v", err)
 	}
 
-	var version migrateSchemaVersion
+	var version migration.MigrationSchemaVersion
 	if err := db.Table("schema_migrations").First(&version).Error; err != nil {
 		t.Fatalf("load schema version: %v", err)
 	}
@@ -190,7 +190,7 @@ func TestRunMigrations_PostgresDownFromVersionThreeDropsPolicyTables(t *testing.
 		t.Fatalf("run down migration: %v", err)
 	}
 
-	var version migrateSchemaVersion
+	var version migration.MigrationSchemaVersion
 	if err := db.Table("schema_migrations").First(&version).Error; err != nil {
 		t.Fatalf("load schema version: %v", err)
 	}

internal/store/search/postgres_test.go

@@ -133,6 +133,15 @@ func TestPostgresFTS_Rebuild(t *testing.T) {
 	}
 }
 
+// disableTSVTrigger turns off the tsv BEFORE INSERT/UPDATE trigger so tests can stage
+// stale tsv values by hand. Tables are dropped per test, so re-enabling is unnecessary.
+func disableTSVTrigger(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	if err := db.Exec("ALTER TABLE search_documents DISABLE TRIGGER trg_search_documents_tsv").Error; err != nil {
+		t.Fatalf("disable tsv trigger: %v", err)
+	}
+}
+
 func TestPostgresFTS_RebuildNodes_RefreshesOnlyScopedRows(t *testing.T) {
 	db := setupPostgresDB(t)
 	backend := NewPostgresBackend()
@@ -157,6 +166,10 @@ func TestPostgresFTS_RebuildNodes_RefreshesOnlyScopedRows(t *testing.T) {
 	if err := db.Create(&model.SearchDocument{Namespace: "ns-b", NodeID: foreign.ID, Content: "fresh foreign", Language: "go"}).Error; err != nil {
 		t.Fatal(err)
 	}
+	// The tsv BEFORE UPDATE trigger would recompute tsv from content and overwrite the
+	// manual stale marker; disable it so the stale state actually exists and RebuildNodes'
+	// own UPDATE statement is what gets verified.
+	disableTSVTrigger(t, db)
 	if err := db.Exec("UPDATE search_documents SET tsv = to_tsvector('simple', 'stale')").Error; err != nil {
 		t.Fatal(err)
 	}
@@ -193,6 +206,9 @@ func TestPostgresFTS_RebuildNodes_EmptyScopeIsNoOp(t *testing.T) {
 	if err := db.Create(&model.SearchDocument{Namespace: ctxns.DefaultNamespace, NodeID: node.ID, Content: "fresh keep", Language: "go"}).Error; err != nil {
 		t.Fatal(err)
 	}
+	// See TestPostgresFTS_RebuildNodes_RefreshesOnlyScopedRows: the trigger must be off
+	// for the stale marker to persist.
+	disableTSVTrigger(t, db)
 	if err := db.Exec("UPDATE search_documents SET tsv = to_tsvector('simple', 'stale')").Error; err != nil {
 		t.Fatal(err)
 	}

internal/webhook/syncqueue_test.go

@@ -14,35 +14,44 @@ import (
 )
 
 func TestSyncQueue_DeduplicatesRapidPushes(t *testing.T) {
-	var callCount atomic.Int32
-	done := make(chan struct{})
+	var svcCalls atomic.Int32
+	gate := make(chan struct{})
+	svcDone := make(chan struct{})
 
 	handler := func(_ context.Context, repoFullName, cloneURL, branch string) error {
-		callCount.Add(1)
-		time.Sleep(50 * time.Millisecond)
-		if callCount.Load() == 1 {
-			close(done)
+		switch repoFullName {
+		case "org/blocker":
+			<-gate
+		case "org/svc":
+			if svcCalls.Add(1) == 1 {
+				close(svcDone)
+			}
 		}
 		return nil
 	}
 
-	q := NewSyncQueue(2, handler)
+	// A single worker held by the gated blocker guarantees all three pushes arrive while
+	// org/svc is queued (never processing), so dedup must collapse them into one run.
+	// Racing the pushes against a free worker made this test flaky under parallel load.
+	q := NewSyncQueue(1, handler)
 	defer q.Shutdown()
 
+	q.Add(context.Background(), "org/blocker", "https://github.com/org/blocker.git", "main")
 	q.Add(context.Background(), "org/svc", "https://github.com/org/svc.git", "main")
 	q.Add(context.Background(), "org/svc", "https://github.com/org/svc.git", "main")
 	q.Add(context.Background(), "org/svc", "https://github.com/org/svc.git", "main")
+	close(gate)
 
 	select {
-	case <-done:
+	case <-svcDone:
 	case <-time.After(5 * time.Second):
 		t.Fatal("timed out waiting for handler")
 	}
 
+	// Grace window so an erroneous duplicate run would surface before the assertion.
 	time.Sleep(100 * time.Millisecond)
 
-	got := callCount.Load()
-	if got != 1 {
+	if got := svcCalls.Load(); got != 1 {
 		t.Errorf("handler called %d times, want 1 (dedup failed)", got)
 	}
 }