docs(k3s): note CONCURRENTLY index verification and SMZDM cover preflight

Document how to confirm the new dedup/lookup indexes finished as valid
(no INVALID leftovers from interrupted CREATE INDEX CONCURRENTLY), and how
to find/abort SMZDM publish tasks queued without a cover before rolling
out the smzdm cover-required check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/k3s/README.md

@@ -81,6 +81,31 @@ kubectl -n geo-rankly logs job/migrate
 kubectl -n geo-rankly logs job/minio-init
 ```
 
+部署包含 `CREATE INDEX CONCURRENTLY` 的迁移前，先在 staging 用与生产完全一致的 migrate 镜像 tag 跑一次完整迁移，确认 golang-migrate 版本和驱动行为一致；发布清单里不要长期沿用 `geo-rankly/migrate:latest`，应在发版时把 `deploy/k3s/kustomization.yaml` 的 `images[].newTag` 固定到本次构建 tag。
+
+迁移完成后，建议检查并发创建的索引是否有效，避免 `CREATE INDEX CONCURRENTLY` 被中断后留下 `INVALID` 索引：
+
+```bash
+kubectl -n geo-rankly exec statefulset/postgres -- sh -lc \
+  'PGPASSWORD="$POSTGRES_PASSWORD" psql -U geo -d geo -c "SELECT indexrelid::regclass AS index_name, indisvalid FROM pg_index WHERE indexrelid::regclass::text LIKE '\''uq_desktop_tasks_publish_dedup%'\'' OR indexrelid::regclass::text LIKE '\''idx_publish_records_article_account_active%'\'' OR indexrelid::regclass::text LIKE '\''idx_desktop_tasks_publish_record_payload%'\'';"'
+```
+
+所有结果的 `indisvalid` 都应为 `t`。若出现 `f`，先 `DROP INDEX CONCURRENTLY IF EXISTS <index_name>`，再重新执行迁移。
+
+升级包含 SMZDM（什么值得买）封面必填逻辑时，建议先确认没有已排队或执行中的 SMZDM 发布任务缺少封面，否则这些旧任务会在新版桌面端回写 `publish_cover_required` 失败：
+
+```bash
+kubectl -n geo-rankly exec statefulset/postgres -- sh -lc \
+  'PGPASSWORD="$POSTGRES_PASSWORD" psql -U geo -d geo -c "SELECT dt.desktop_id, dt.status, dt.created_at FROM desktop_tasks dt JOIN publish_records pr ON pr.id = CASE WHEN (dt.payload->>'\''publish_record_id'\'') ~ '\''^[0-9]+$'\'' THEN (dt.payload->>'\''publish_record_id'\'')::bigint ELSE NULL END JOIN publish_batches pb ON pb.id = pr.publish_batch_id WHERE dt.kind = '\''publish'\'' AND dt.platform_id = '\''smzdm'\'' AND dt.status IN ('\''queued'\'', '\''in_progress'\'') AND dt.payload ? '\''publish_record_id'\'' AND COALESCE(NULLIF(pb.cover_asset_url, '\'''\''), NULLIF(dt.payload#>> '\''{content_ref,cover_asset_url}'\'', '\'''\'')) IS NULL ORDER BY dt.created_at DESC;"'
+```
+
+确认这些旧任务可废弃后，可先中止仍在排队的任务，避免升级后集中失败；`in_progress` 任务需等待租约结束或由客户端回写：
+
+```bash
+kubectl -n geo-rankly exec statefulset/postgres -- sh -lc \
+  'PGPASSWORD="$POSTGRES_PASSWORD" psql -U geo -d geo -c "WITH stale AS (SELECT dt.desktop_id FROM desktop_tasks dt JOIN publish_records pr ON pr.id = CASE WHEN (dt.payload->>'\''publish_record_id'\'') ~ '\''^[0-9]+$'\'' THEN (dt.payload->>'\''publish_record_id'\'')::bigint ELSE NULL END JOIN publish_batches pb ON pb.id = pr.publish_batch_id WHERE dt.kind = '\''publish'\'' AND dt.platform_id = '\''smzdm'\'' AND dt.status = '\''queued'\'' AND dt.payload ? '\''publish_record_id'\'' AND COALESCE(NULLIF(pb.cover_asset_url, '\'''\''), NULLIF(dt.payload#>> '\''{content_ref,cover_asset_url}'\'', '\'''\'')) IS NULL) UPDATE desktop_tasks dt SET status = '\''aborted'\'', error = jsonb_build_object('\''reason'\'', '\''smzdm_cover_required_upgrade_abort'\'', '\''source'\'', '\''ops_upgrade'\''), active_attempt_id = NULL, lease_token_hash = NULL, lease_expires_at = NULL, updated_at = NOW() FROM stale WHERE dt.desktop_id = stale.desktop_id RETURNING dt.desktop_id;"'
+```
+
 如果是升级后需要重新跑迁移：
 
 ```bash