trace-store: fix old-schema migration crash (found by live boot)

Wave 1 created idx_records_bodyHash BEFORE migrateOldBodies ran, so opening a
pre-existing old-schema traces.db crashed the collector with 'no such column:
bodyHash' (crash-looped 168x in ~20s). Fresh DBs hid it (CREATE TABLE already
has bodyHash); only a real old-schema DB exposed it.

- reorder schema(): migrateOldBodies (ALTER ADD bodyHash + content-address
  backfill + drop old bodies) runs BEFORE the bodyHash index.
- add 3 regression tests that seed a real old-schema DB and open it.

Live-verified: old-schema traces.db migrates on boot with 0 crashes; 318 body
refs collapse to 270 content-addressed bodies; prune cadence fires cleanly.
typecheck EXIT 0; biome clean; bun 106->109, 0 fail.

1 files changed, 10 insertions, 3 deletions

diff --git a/tasks.md b/tasks.md
index 8cd0a8b..0cfcbb1 100644
--- a/tasks.md
+++ b/tasks.md
@@ -82,9 +82,16 @@ deferred); dedup = **content-addressed bodies** (body-hash, NOT fingerprint-gate
   error.
 - [x] Glossary: added content-addressed body, trace retention, prefix fingerprint,
   warm vs real.
-- Tests: bun 89→106. typecheck/biome clean. (Retention is a background tick — no
-  request-path change, no live boot needed; covered by real-store + injected-clock
-  tests.) Optional follow-up: host-bin env-override for the retention policy.
+- [x] **Migration bug** (found by live boot, fixed): Wave 1 created the
+  `idx_records_bodyHash` index BEFORE running `migrateOldBodies`, so opening a
+  pre-existing OLD-schema `traces.db` crashed the collector
+  (`no such column: bodyHash`, crash-looped). Fix = reorder migration before the
+  index + 3 regression tests that seed a real old-schema DB. bun 106→109.
+- Tests: bun 89→109. typecheck/biome clean. **Live-verified** against a real
+  old-schema `traces.db`: 0 crashes, collector stays up, schema migrates
+  (bodyHash + content-addressed bodies), real-data dedup (318 body refs → 270
+  stored bodies), prune cadence fires cleanly (14× `prune completed`). Optional
+  follow-up: host-bin env-override for the retention policy.
 
 ## Open items
 - **`prefix.fingerprint` / `warm|real` cache-bust attributes (deferred):** decoupled