Detect additive generation schema migrations in readiness checks

app/security/database.py

@@ -191,6 +191,28 @@ class SecurityDatabase:
             )
         return missing
 
+    async def missing_schema_columns(self) -> list[str]:
+        """Report columns introduced by additive migrations that create_all cannot repair."""
+        required = {
+            "generation_requests": {"project_id", "product_surface"},
+            "generation_jobs": {"brand_kit_version_id"},
+            "generation_job_attempts": {"error_code"},
+        }
+        async with self.engine.connect() as connection:
+            def inspect_columns(sync_connection):
+                inspector = inspect(sync_connection)
+                tables = set(inspector.get_table_names())
+                missing: list[str] = []
+                for table, expected in required.items():
+                    if table not in tables:
+                        continue  # Missing tables are reported by missing_schema_objects().
+                    columns = {column["name"] for column in inspector.get_columns(table)}
+                    missing.extend(
+                        f"column:{table}.{name}" for name in sorted(expected - columns)
+                    )
+                return missing
+            return await connection.run_sync(inspect_columns)
+
     async def missing_tables(self) -> list[str]:
         async with self.engine.connect() as connection:
             tables = await connection.run_sync(lambda sync: set(inspect(sync).get_table_names()))