fix: probe for the telemetry table before creating it

PostgreSQL checks the schema CREATE privilege before the IF NOT EXISTS
existence test, so an account with only table-level INSERT was denied on
CREATE TABLE IF NOT EXISTS even though the table was right there and
writable. The denial set _failed and the whole recorder went no-op for
the process lifetime, silently: 150+ calls downstream lost their latency,
token and cost rows with nothing but one warning to show for it.

The probe is the direct fix. The larger fix is the criterion: structural
degradation now means "provably cannot write" (pool creation failed, or
the table is absent and cannot be created), not "something threw during
init" -- a probe or acquire failure just skips the row and retries on the
next call.

SQLite stays as it is on purpose. Measured: it short-circuits the
statement at parse time, so it passes even under another connection's
EXCLUSIVE lock or on a read-only file. A probe there would buy nothing;
the docstring now says so to keep symmetry-minded future edits away.

tests/integration/test_postgres_telemetry.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 import asyncio
 import json
 import os
+import re
 from uuid import uuid4
 
 import pytest
@@ -299,3 +300,88 @@ class TestDegradation:
         await _record_minimal(recorder)
         await recorder.aclose()
         await recorder.aclose()
+
+
+_PROBE_PASSWORD = "pgw_issue9_probe"  # 临时角色,teardown 删除;非任何真实凭据
+
+
+@pytest.fixture
+async def least_privilege_dsn(dsn):
+    """临时 schema + 临时角色: 只授表级 SELECT/INSERT,**不授 schema CREATE**。
+
+    这是 issue #9 的现场——最小权限部署的标准形态。fixture 建的一切
+    (schema、表、角色)都在 teardown 里删净,共享的 public.llm_calls 不受影响;
+    连不上或无权建角色(非超级用户)时 skip,不让 CI 假绿。
+    """
+    import asyncpg
+
+    from polygateway.telemetry.postgres import _DDL
+
+    name = f"pgwtest_lp_{uuid4().hex[:8]}"
+    admin = await asyncpg.connect(dsn, timeout=10)
+    try:
+        if not await admin.fetchval(
+            "SELECT rolcreaterole OR rolsuper FROM pg_roles WHERE rolname = current_user"
+        ):
+            pytest.skip("当前账号无权建临时角色,跳过最小权限用例")
+        await admin.execute(f"CREATE ROLE {name} LOGIN PASSWORD '{_PROBE_PASSWORD}'")
+        await admin.execute(f"CREATE SCHEMA {name}")
+        await admin.execute(f"SET search_path = {name}")
+        await admin.execute(_DDL)  # 表由**别的账号**建好,与现场一致
+        await admin.execute(f"GRANT USAGE ON SCHEMA {name} TO {name}")
+        await admin.execute(f"GRANT SELECT, INSERT ON {name}.llm_calls TO {name}")
+        # 关键: 绝不 GRANT CREATE ON SCHEMA —— 缺的正是这一项
+    finally:
+        await admin.close()
+    low = re.sub(r"//[^@/]+@", f"//{name}:{_PROBE_PASSWORD}@", dsn, count=1)
+    sep = "&" if "?" in low else "?"
+    yield f"{low}{sep}options=-csearch_path%3D{name}", name
+    admin = await asyncpg.connect(dsn, timeout=10)
+    try:
+        await admin.execute(f"DROP SCHEMA IF EXISTS {name} CASCADE")
+        await admin.execute(f"DROP OWNED BY {name}")
+        await admin.execute(f"DROP ROLE IF EXISTS {name}")
+    finally:
+        await admin.close()
+
+
+class TestLeastPrivilegeDeployment:
+    """issue #9: 只有表级写权限的账号,遥测必须照常落库而不是整体判死。"""
+
+    async def test_create_table_if_not_exists_is_denied_for_this_role(self, least_privilege_dsn):
+        """库外事实先钉死: 表存在、写得进去,DDL 仍被拒——PG 的权限检查早于 IF NOT EXISTS。
+
+        修复依赖的是这条 PG 语义;若某天它变了,这里先红,而不是让下面那条
+        用例悄悄变成"永远通过"的空断言。
+        """
+        import asyncpg
+
+        low_dsn, _ = least_privilege_dsn
+        conn = await asyncpg.connect(low_dsn, timeout=10)
+        try:
+            assert await conn.fetchval("SELECT to_regclass('llm_calls')") is not None
+            with pytest.raises(asyncpg.exceptions.InsufficientPrivilegeError):
+                await conn.execute("CREATE TABLE IF NOT EXISTS llm_calls (call_id TEXT)")
+        finally:
+            await conn.close()
+
+    async def test_records_land_without_schema_create_privilege(self, least_privilege_dsn):
+        """修复前: 建表被拒 → _failed → 整个进程一条不落(下游 150 次调用全丢)。"""
+        low_dsn, schema = least_privilege_dsn
+        recorder = PostgresRecorder(low_dsn)
+        try:
+            await _record_minimal(recorder, call_id=_cid("lp1"))
+            await _record_minimal(recorder, call_id=_cid("lp2"), cost=1.5)
+            assert recorder._failed is False  # 判死开关不得被建表权限触发
+            rows = await _fetch(
+                low_dsn,
+                "SELECT call_id, cost FROM llm_calls WHERE call_id LIKE $1 ORDER BY call_id",
+                f"{_RUN_PREFIX}-lp%",
+            )
+            assert [(r["call_id"], r["cost"]) for r in rows] == [
+                (_cid("lp1"), None),
+                (_cid("lp2"), 1.5),
+            ]
+            assert schema  # teardown 会连表带角色删净
+        finally:
+            await recorder.aclose()