7309d1d6d4
Every web replica runs 'alembic upgrade head' in its entrypoint, so under docker stack deploy two replicas can boot at once and race the same DDL — 0040 raced in prod (operator-flagged 2026-06-07): one backend wedged on the series_page lock while a second tried to re-CREATE series_chapter, and the loser died with AdminShutdown, crash-looping the web service. Wrap run_migrations() in a transaction-scoped pg_advisory_xact_lock acquired BEFORE the version table is read. The first replica to reach it migrates and holds the lock for the whole upgrade; siblings block, then find the version already at head and apply nothing. Works regardless of replica count and needs no Swarm depends_on ordering (which stack deploy ignores anyway). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>