Version: 0.1
Status: Recorded finding, with a one-off fix already applied to playground_dev. Surfaced during CR-2026-153 step 1–4 mint verification, this session (2026-07-17).
playground_dev's stele_alembic_version table was empty — Stele's own migration chain had never been run against it — while Stele's migration head sits at 0002_totp_last_step, from the completed TS-11 TOTP-replay-protection CR (pushed to stele main in June). POST /auth/dev/issue-session broke as a result: principals.totp_last_step didn't exist, so get_principal_by_id's SELECT 500'd with UndefinedColumnError. That route is the only sanctioned way to mint a session without the WebAuthn + TOTP ceremony — nothing surfaced the failure until this session needed it, which means nothing had exercised that endpoint since June.
This is the same class of drift CR-2026-150 (Stele Migration Chain Version-Table Collision) fixed the structural cause of. Before that CR, Stele's and the engine's migration chains shared the default alembic_version table and collided outright. CR-2026-150's fix — version_table="stele_alembic_version" in stele/src/stele/migrations/env.py — is confirmed live in the repo today, and separated the two chains so each can run independently against a shared database.
Separating the chains doesn't retroactively apply anything, though — each database still needs its own alembic upgrade head run against it. CR-2026-150's own text records that a "one-off manual fix" was applied at the time to unblock playground_test (864 failing tests). Nothing in that CR, or since, appears to have done the same for playground_dev — it sat with an empty stele_alembic_version and a missing column for over a month, undiscovered because nothing exercised the dev-session route in that window.
With Operator direction: confirmed the migration's contents before running it (a single additive ADD COLUMN principals.totp_last_step INTEGER NULL — no default, no backfill, no other table touched) and that it's tracked in Stele's own stele_alembic_version table, separate from the engine's alembic_version (confirmed still at revision 0097, untouched). Stamped playground_dev at 0001_baseline (the table already existed, created before the Stele extraction) and ran alembic upgrade head to 0002_totp_last_step. POST /auth/dev/issue-session now succeeds.
A single-column ADD COLUMN on principals cannot touch any other table. The live engagement (E0060) and the E0007 / E0030 / E0006 fixtures were not affected.
This fix only touched playground_dev. Nothing here checked staging or production databases, if they exist, for the same drift. Any environment where Stele's migrations haven't been explicitly run since CR-2026-150 landed is a candidate for the same UndefinedColumnError on the same route — or, less visibly, for TOTP replay protection silently not applying if totp_last_step matters beyond that one column's presence. Worth an explicit check before this is considered closed everywhere.
Recorded. playground_dev fixed as a one-off, the same shape as CR-2026-150's playground_test fix. Not a CR — no code change, no seed conflict. Whether a structural fix belongs here (a migration-currency check at engine startup, or a runbook step for provisioning a new database) is left for whoever picks this up.