fix(automation): enforce durable alert closure

Restore D037 durable incident readback without weakening database failure semantics.

Fence Agent99 dispatch and terminal learning to canonical identities, durable leases, verifier receipts, and reconciler-owned checkpoints.

Drain backup and restore legacy receipts in bounded cohorts with strict transport, claim, projection, and no-false-green controls.

Keep SSH service refusal visible while separating it from broker network-policy reachability.

apps/api/tests/test_runtime_bootstrap_guards.py

@@ -365,3 +365,49 @@ def test_init_db_backfills_all_optional_knowledge_read_columns() -> None:
     assert "ADD COLUMN IF NOT EXISTS path_type" in source
     assert "ADD COLUMN IF NOT EXISTS symptoms_hash" in source
     assert "CREATE INDEX IF NOT EXISTS ix_knowledge_symptoms_hash" in source
+
+
+def test_init_db_bootstraps_agent99_retry_schema_before_serving() -> None:
+    import inspect
+
+    from src.db import base as db_base
+
+    source = inspect.getsource(db_base._run_init_db_ddl)
+    column_ddl = (
+        "ADD COLUMN IF NOT EXISTS next_attempt_at TIMESTAMP NULL"
+    )
+    index_ddl = "CREATE INDEX IF NOT EXISTS idx_run_state_retry_due"
+
+    assert "ALTER TABLE awooop_run_state" in source
+    assert column_ddl in source
+    assert index_ddl in source
+    assert "WHERE state = 'pending' AND next_attempt_at IS NOT NULL" in source
+    assert source.index(column_ddl) < source.index("ALTER TABLE approval_records")
+
+
+def test_agent99_retry_migration_matches_startup_bootstrap() -> None:
+    migrations = Path(__file__).resolve().parents[1] / "migrations"
+    up = (
+        migrations / "agent99_dispatch_next_attempt_at_2026-07-11.sql"
+    ).read_text(encoding="utf-8")
+    down = (
+        migrations / "agent99_dispatch_next_attempt_at_2026-07-11_down.sql"
+    ).read_text(encoding="utf-8")
+
+    assert "ADD COLUMN IF NOT EXISTS next_attempt_at TIMESTAMP NULL" in up
+    assert "CREATE INDEX IF NOT EXISTS idx_run_state_retry_due" in up
+    assert "WHERE state = 'pending' AND next_attempt_at IS NOT NULL" in up
+    assert down.index("DROP INDEX IF EXISTS idx_run_state_retry_due") < (
+        down.index("DROP COLUMN IF EXISTS next_attempt_at")
+    )
+
+
+def test_api_runs_retry_schema_bootstrap_before_agent99_reconciler() -> None:
+    import inspect
+
+    from src import main as api_main
+
+    source = inspect.getsource(api_main.lifespan)
+    assert source.index("await init_db()") < source.index(
+        "run_agent99_controlled_dispatch_reconciler_loop()"
+    )