The alembic revisions this database has applied.

Exists so the deploy gate can ask whether production's schema is ready for the code about to ship WITHOUT CI holding a production database credential. It is a single read and never writes.

The failure it guards: a feature merged whose migration had not run, because alembic upgrade head is ambiguous with several heads and advanced none of them. Flights became persisted plan entries while the constraint permitting them did not exist, so every trip with flights 5xx'd for hours and nothing noticed. Revision ids are not sensitive; the endpoint is unauthenticated for the same reason /health is.