Guard released migration lineage and dependencies

[yaacovcorcos]

User impact

This is preventive reliability work: users should not see a new control, but future releases can no longer silently rewrite, renumber, rename, delete, or detach already-shipped database migrations or change the reviewed runtime dependency resolution beneath them.

The guard also safety-checks every current unreleased migration before it can ship and fails closed on unresolved, escaping, ambiguous, absolute, dynamic, runtime-loader, or unpinned workspace imports.

Upstream provenance and disposition

• Reliability lesson from Synara 5495a6e81e4da80e996867a1c487c9546cbd0196, where recovery work exposed migration-history risk.
• Disposition: Reimplement as a Scient-owned append-only lineage gate.
• Not imported: Synara's recovery engine, migration aliases, replay policy, database replacement behavior, storage model, or product assumptions.

Exact candidate

• Base: dab9b6d58e2a3f3da02c5475b86dc083f71580f1
• Head: d97a131bb286d7e3994ee400c9e494250329038e
• Branch: maintenance/upstream-migration-lineage-20260725
• Worktree: clean
• Base is an ancestor of head; the branch update was a normal fast-forward push.

What is protected

• Exact frozen migration tuples, canonical IDs/names/imports/files/catalog mapping, and the executable Migrator import.
• Identity and exact historical source content across all 79 official release tags, with only the documented pre-guard Git-blob allowances and the exact historic migration-32 identity repair.
• Latest shipped dependency closure selected from actual release/stable first-parent ancestry, not semantic version ordering.
• The release-trigger case where one new unmanifested tag exists at HEAD, while an already-manifested HEAD tag remains authoritative.
• Transitive repository-local runtime dependencies and the exact @synara/contracts package/barrel/runtime binding used by migration 35.
• Root/server/contracts manifest, catalog, workspace, lockfile, Effect tuple, patch declarations, and patch-file bytes that determine migration runtime resolution.
• Fail-closed rejection of dynamic/module loaders, eval/function constructors, global/process/module/import-meta access, runtime network/worker loaders, unsafe local resolution, and arbitrary external runtime packages.
• CI and release workflows fetch official release history and run bun run migration:check.

Verification at exact head

• Focused lineage suite: 31/31.
• Live bun run migration:check: 59 contiguous migrations; 79 protected official release tags; all historical migration code and latest shipped dependency resolution match v0.5.13.
• Complete bun run scient:upstream-check --intake: passed identity, format, lint (0 errors), all typechecks, full bun run test, all builds, release smoke, and clean certification.
• Full tests: web 3087/3087; server/CLI 2331 passed, 9 skipped.
• git diff --check clean; tests created no tracked or untracked artifacts.

Independent review

Exactly three fresh, independent, read-only reviews inspected the full seven-file diff at d97a131bb286d7e3994ee400c9e494250329038e:

1. Correctness, reliability, migration history, dependency closure, release ordering, and data-loss risk: CLEAR, no P0-P3.
2. Security, supply-chain integrity, tag/ref trust, loader bypasses, and release safety: CLEAR, no P0-P3.
3. Architecture, maintainability, CI ownership, provenance, tests, and performance: CLEAR, no P0-P3.

The final pre-push review found one P2 in the prior candidate: semantic-version sorting could choose an older dependency baseline after a later lower-version release. The candidate now selects by actual release-branch ancestry and includes a regression for that ordering.

Safety, rollback, and limitations

• The validation is read-only: it never opens, migrates, restores, replaces, or mutates a user database.
• No provider, credential, session, updater-authority, packaging, UI, or shared-contract runtime behavior changes.
• Rollback is a PR revert; it removes the release guard without altering user data.
• The guard is intentionally strict. Deliberate future migration dependency or loader changes require explicit reviewed updates rather than silent acceptance.

Hosted CI

A new hosted CI run was launched automatically for exact head d97a131bb286d7e3994ee400c9e494250329038e and must be fully green before merge.

Related intake PRs

• Crash-loop breaker: Bound repeated desktop backend crash restarts #126
• Diff/Git refresh: Keep diff mode and Git status refresh responsive #127
• New-chat project picker: Make the new-chat project heading interactive #128
• Parent recovery research record: ScientFactory/Scient#49

[yaacovcorcos]

Final integration refresh (2026-07-25): current main dab9b6d was merged normally into this branch; no rebase or force-push. Exact hosted head: ed75c03. Migration-lineage tests 14/14 and the live migration lineage check passed. git diff --check passes and the task worktree is clean. Fresh hosted CI run https://github.com/ScientFactory/scient-desktop/actions/runs/30160243863 completed successfully, including format, lint, typecheck, full bun run test, stable browser, Linux geometry, desktop build/preload, release smoke, Linux and Windows HTML-preview smoke, and Windows process regression. No unresolved review threads remain. Existing documented manual limitations are unchanged and non-blocking. This candidate is integration-ready against main dab9b6d; this is not merge or release authorization.