feat: gate the automatic ALTER behind an explicit mode

两个 recorder 的 `__init__` 增 keyword-only 必填 `auto_migrate`(设计 D-c:
缺省规则只写在 config 一处,不与类签名漂移),并把写入语句从模块级常量改为
实例级: manual 档探测到旧表缺列时一条 ALTER 都不发,改按现有列裁剪 INSERT,
准备期发一次 warning(逐列点名 + "以下维度不会被记录" + 可直接执行的补列 SQL)。

裁剪是关掉 ALTER 的前提而非增强: 旧表缺列时若既不 ALTER 又不裁剪,每一行
INSERT 都撞 `no column named tenant_id` 被整行丢弃,比自动 ALTER 更严重地
违反"遥测必录"。auto 档行为逐字不变(先探测后 ALTER、duplicate column 视为
成功、失败只 warning 不判死、写入沿用全量列)。

探测失败、或探测结果与 COLUMNS 毫无交集,两档都保守回落全量列——空列集会让
`insert_sql` 产出 `INSERT INTO llm_calls () VALUES ()`(它不拒空列表,空集
技术上是子集)。PG 侧 `_columns`/`_insert` 与 `_schema_ready` 在同一处一起
赋值,不留"已就绪但语句还是旧的"窗口。

同批改 `GatewaySettings.telemetry_auto_migrate`(按后端派生: PG False、
SQLite True)与 `client._build_telemetry` 透传: 签名变更与其唯一调用点必须
落在同一次提交,否则该提交点整条装配路 TypeError。env 键留给下一步。

tests/integration/test_governance_stack.py

@@ -119,7 +119,7 @@ class TestBreakerRecoveryFullChain:
 
 class TestCancellationThroughStack:
     async def test_cancel_mid_request_releases_and_records(self, tmp_path):
-        recorder = SQLiteRecorder(tmp_path / "t.db")
+        recorder = SQLiteRecorder(tmp_path / "t.db", auto_migrate=True)
         entered = asyncio.Event()
 
         async def hanging_handler(request):
@@ -144,7 +144,7 @@ class TestCancellationThroughStack:
 
 class TestTelemetryAcrossPaths:
     async def test_success_cache_hit_and_failure_rows(self, tmp_path):
-        recorder = SQLiteRecorder(tmp_path / "t.db")
+        recorder = SQLiteRecorder(tmp_path / "t.db", auto_migrate=True)
         client = _full_client(lambda req: _sse(), telemetry=recorder, cache=InMemoryCache())
         await client.chat([{"role": "user", "content": "hi"}])  # 成功(尝试行)
         await client.chat([{"role": "user", "content": "hi"}])  # 缓存命中行
@@ -155,7 +155,7 @@ class TestTelemetryAcrossPaths:
         assert hits == 1 and total == 2
 
     async def test_transient_attempts_each_recorded(self, tmp_path):
-        recorder = SQLiteRecorder(tmp_path / "t.db")
+        recorder = SQLiteRecorder(tmp_path / "t.db", auto_migrate=True)
         calls = {"n": 0}
 
         def flaky(request):
@@ -193,7 +193,7 @@ class TestRejectionReasonIsQueryable:
     )
 
     async def test_rejected_call_leaves_the_reason_in_telemetry(self, tmp_path):
-        recorder = SQLiteRecorder(tmp_path / "t.db")
+        recorder = SQLiteRecorder(tmp_path / "t.db", auto_migrate=True)
         client = _full_client(
             lambda req: httpx.Response(400, content=self._BODY.encode()), telemetry=recorder
         )
@@ -257,7 +257,7 @@ class TestSamplingThroughStack:
             return _sse()
 
         db = tmp_path / "t.db"
-        recorder = SQLiteRecorder(db)
+        recorder = SQLiteRecorder(db, auto_migrate=True)
         client = _full_client(handler, telemetry=recorder)
         await client.chat([{"role": "user", "content": "hi"}], overlay={"seed": 42})
         recorder.close()
@@ -276,7 +276,7 @@ class TestSamplingThroughStack:
 
         src = dataclasses.replace(_source(), extra_body={"temperature": 0})
         db = tmp_path / "t.db"
-        recorder = SQLiteRecorder(db)
+        recorder = SQLiteRecorder(db, auto_migrate=True)
         client = GatewayClient(
             scope="llm",
             sources=[src],

tests/integration/test_postgres_telemetry.py

@@ -185,7 +185,7 @@ class TestObservabilityColumns:
     """issue #3: 两列写入可回读,且已存在的 18 列旧表会被自动补列。"""
 
     async def test_values_round_trip(self, dsn):
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("hit"), cached_prompt_tokens=64)
             await _record_minimal(recorder, call_id=_cid("zero"), cached_prompt_tokens=0)
@@ -213,7 +213,7 @@ class TestObservabilityColumns:
     async def test_legacy_table_is_upgraded_in_place(self, legacy_schema):
         """18 列旧表不补列的话,每行写入都会被逐行 warning 丢弃(遥测静默全失)。"""
         schema_dsn, schema = legacy_schema
-        recorder = PostgresRecorder(schema_dsn)
+        recorder = PostgresRecorder(schema_dsn, auto_migrate=True)
         try:
             await _record_minimal(
                 recorder, call_id=_cid("legacy"), cached_prompt_tokens=7, model_reported="m-real"
@@ -238,7 +238,7 @@ class TestObservabilityColumns:
 
 class TestSchema:
     async def test_schema_has_frozen_columns_in_order(self, dsn):
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder)
             rows = await _fetch(
@@ -251,7 +251,7 @@ class TestSchema:
             await recorder.aclose()
 
     async def test_call_id_idempotent(self, dsn):
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("dup"))
             await _record_minimal(recorder, call_id=_cid("dup"), response="second")
@@ -263,7 +263,7 @@ class TestSchema:
             await recorder.aclose()
 
     async def test_concurrent_writes_all_land(self, dsn):
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         try:
             await asyncio.gather(
                 *(_record_minimal(recorder, call_id=_cid(f"c{i}")) for i in range(50))
@@ -281,14 +281,14 @@ class TestSchema:
 class TestDegradation:
     async def test_unreachable_server_degrades_silently(self):
         """结构性失败(建池不通)→ warning 一次后永久降级,业务零感知。"""
-        recorder = PostgresRecorder("postgresql://u:p@127.0.0.1:1/x")
+        recorder = PostgresRecorder("postgresql://u:p@127.0.0.1:1/x", auto_migrate=True)
         await _record_minimal(recorder)  # 不抛
         await _record_minimal(recorder, call_id=_cid("c2"))  # 已降级短路,同样不抛
         await recorder.aclose()
 
     async def test_row_failure_does_not_poison_later_rows(self, dsn):
         """运行时单条写失败(NUL 字节文本被 PG 拒)→ 丢该行,后续行照常落库。"""
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("bad"), response="nul\x00byte")
             await _record_minimal(recorder, call_id=_cid("good"))
@@ -302,7 +302,7 @@ class TestDegradation:
             await recorder.aclose()
 
     async def test_aclose_idempotent(self, dsn):
-        recorder = PostgresRecorder(dsn)
+        recorder = PostgresRecorder(dsn, auto_migrate=True)
         await _record_minimal(recorder)
         await recorder.aclose()
         await recorder.aclose()
@@ -374,7 +374,7 @@ class TestLeastPrivilegeDeployment:
     async def test_records_land_without_schema_create_privilege(self, least_privilege_dsn):
         """修复前: 建表被拒 → _failed → 整个进程一条不落(下游 150 次调用全丢)。"""
         low_dsn, schema = least_privilege_dsn
-        recorder = PostgresRecorder(low_dsn)
+        recorder = PostgresRecorder(low_dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("lp1"))
             await _record_minimal(recorder, call_id=_cid("lp2"), cost=1.5)
@@ -534,7 +534,7 @@ class TestCallerDimensionsAcceptance:
     async def test_fresh_schema_round_trips_the_dimensions(self, fresh_schema):
         """新建库: 列齐全,且维度值原样读回——只验列存在会漏掉写错列位的错。"""
         fresh_dsn, schema = fresh_schema
-        recorder = PostgresRecorder(fresh_dsn)
+        recorder = PostgresRecorder(fresh_dsn, auto_migrate=True)
         try:
             await _record_minimal(
                 recorder, call_id=_cid("dim"), tenant_id="tenant-a", meta='{"batch": "b7"}'
@@ -568,7 +568,7 @@ class TestCallerDimensionsAcceptance:
         审计出来,历史欠账是可见、可量化、可补录的。
         """
         schema_dsn, schema = pre_tenant_schema
-        recorder = PostgresRecorder(schema_dsn)
+        recorder = PostgresRecorder(schema_dsn, auto_migrate=True)
         try:
             await _record_minimal(
                 recorder, call_id=_cid("new"), tenant_id="tenant-a", meta='{"k": 1}'
@@ -620,7 +620,7 @@ class TestCallerDimensionsAcceptance:
         置 `_failed` 会让整个进程从此一条遥测都不写(比逐行丢弃严重得多),
         且一旦 DBA 补上列也不会自愈——必须等重启。
         """
-        recorder = PostgresRecorder(least_privilege_pre_tenant_dsn)
+        recorder = PostgresRecorder(least_privilege_pre_tenant_dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("lpp1"))  # 不得抛
             assert recorder._failed is False
@@ -716,7 +716,7 @@ class TestConflictTargetFreeInsert:
         断言"无写入失败 warning"是为了区分"冲突被忽略"与"整条被 PG 拒收"。
         """
         fresh_dsn, _ = fresh_schema
-        recorder = PostgresRecorder(fresh_dsn)
+        recorder = PostgresRecorder(fresh_dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("nodup"))
             await _record_minimal(recorder, call_id=_cid("nodup"), response="second")
@@ -737,7 +737,7 @@ class TestConflictTargetFreeInsert:
         遥测全线写不进去却一声不吭,只能靠"读不回来"暴露。
         """
         part_dsn, _ = partitioned_schema
-        recorder = PostgresRecorder(part_dsn)
+        recorder = PostgresRecorder(part_dsn, auto_migrate=True)
         try:
             await _record_minimal(recorder, call_id=_cid("part"), tenant_id="tenant-p")
             assert [m for m in captured_warnings if "写入失败" in m] == []