feat(schema): retrofit storage_parameters onto existing partition children

[tthayer]

What was broken

PR #159 (v0.12.2) made storage_parameters reach partition children at creation
time. Nothing retrofitted children that already existed.

Which strategy that actually mattered for:

• Tenant-list partitions (partitioned = true) — the real problem. They never
  roll over. A child created before the model declared the option keeps the default
  forever, silently.
• KSUID and date partitions self-heal: retention rolls old children out and new ones
  are created with the declared WITH (...).

The change

At the end of Migrations():

if isPartitionedParent(desc) && desc.GetStorageParameters() != nil {
    children, err := readPartitionChildStorageParameters(ctx, db, desc)
    ...
    rv = append(rv, partitionChildAlters(desc, children, maxPartitionChildStorageParamAlters)...)
}

Three deliberate properties:

1. Emitted last. The consumer (c1 pkg/postgres/xpgdb/schema.go) breaks out of a
   table's statement loop on the first 55P03 lock_timeout. Putting child ALTERs last
   means a contended tenant partition can only cost other child ALTERs — never the
   column-adds and index statements ahead of them.
2. Capped at 50 per run (maxPartitionChildStorageParamAlters), ordered by child
   name. Bounds lock churn on a many-tenant table — each ALTER TABLE ... SET (...)
   takes a brief ACCESS EXCLUSIVE lock. Self-advancing: converged children render
   nothing, so the next run's first 50 are the next 50 that actually drift.
3. Diff-driven. Reuses the existing per-key diff via a new
   storageParams2alterTable(desc, tableName, existingParams); storageParams2alter
   is now a one-line wrapper, so TestStorageParams2alter is unchanged and still
   passes. No blanket re-SET, no churn on already-correct children.

Also folds the duplicated reloptions key=value parsing into a shared
parseReloptions used by both the parent and the new child reader. The new
pg_inherits reader mirrors the existing readStorageParameters shape (same goqu
parameterization, same nspname = 'public' scoping).

Only costs an extra catalog query when the model is a partitioned parent and
declares storage parameters. Migrations still early-returns CreateSchema when the
table does not exist, so the retrofit block never runs on a fresh table.

Tests

pgdb/v1/schema_sql_test.go — TestPartitionChildAlters: 120 drifted children
truncate to exactly 50 in name order (first is parent_000, last parent_049); a
converged set emits nothing; a descriptor with no declaration emits nothing.

example/models/food/v1/food_test.go — TestPartitionChildStorageParamRetrofit
simulates the real case end to end against a live Postgres: create the tenant-list
partitioned Pasta table (declares fillfactor: 90) plus three tenant children,
assert Migrations emits nothing while they are converged, then
ALTER TABLE <child> RESET (fillfactor) on one of the three to look like a
pre-declaration child. Asserts exactly that child is retrofitted, applies the ALTER,
verifies fillfactor = 90 landed, and asserts a third Migrations call emits nothing.

Negative test confirmed: with the retrofit block disabled,
TestPartitionChildStorageParamRetrofit fails with "[]" should have 1 item(s), but has 0 / only the stale child should be retrofitted. The test genuinely guards the
behaviour rather than passing vacuously.

Residual limitation

execReconcile in the consumer notes that a 55P03 skip is "not self-healing
in-process" — it retries only on the next EnsureSchema, i.e. a redeploy. So a large
retrofit converges across deploys rather than within one: at 50/run, a 5,000-tenant
table needs ~100 deploys. Related: because the consumer abandons the remainder of a
table's statements on the first lock_timeout, a perpetually contended child head-of-line
blocks the children after it in name order for that run. Both are inherent to the
consumer's break-on-lock_timeout semantics, and both are strictly better than the status
quo, where nothing converged at all. maxPartitionChildStorageParamAlters is the knob
if the deploy count ever matters.

Linear: IGA-3716

Note: the ticket's "route lock behaviour through reconcileLockTimeout / 55P03"
criterion required no code here — that machinery lives in the consumer, not this
library.

🤖 Generated with Claude Code

[linear-code]

IGA-3716