fix(state): repair legacy usage-profile migration stamp

[andrei-hasna]

References Todos task 2637d518-f731-4221-8985-2218c495ce39.

PR #532 fixed fresh state initialization by preserving thread-monitor authorization as migration 0068 and moving usage-profile leases to 0069. This follow-up adds a deterministic state-migrator duplicate-version regression and repairs legacy databases created from downloadable PR #528 artifacts, where usage-profile leases was recorded at version 68. Without the repair, SQLx rejects startup with UNIQUE constraint failed: _sqlx_migrations.version / migration version mismatch before the current 0068 migration can apply.

The compatibility repair is checksum-guarded: it changes only the historical version-68 usage-profile lease stamp to 69, then normal migration applies the preserved thread-monitor 0068 migration.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[ERDOS-R5-PR534-INITIAL-07BFB452]
Reviewer: Erdos — sole fixed independent adversarial reviewer.
VERDICT: NO_GO.

Exact candidate controls:
PR_CONTROL state=OPEN draft=false head=07bfb452e724b60a1fa6fde582a4a05b7063402c tree=65b3ded13b4e9cdf5d66fb98d720f6f5966dd1a2 base/current-main=905826510829d1456423f45fc67d329cae3dd33c base_tree=7069f127c740e91a8b05ec95c32d21dcbdeca8f1 parents=a8e3df1766119d7656d723806244151fc6486bbd,905826510829d1456423f45fc67d329cae3dd33c.
git diff --name-status base..head: M codex-rs/state/src/migrations.rs; M codex-rs/state/src/runtime.rs. merge-tree=65b3ded13b4e9cdf5d66fb98d720f6f5966dd1a2.
SHA384_CONTROL PR528_0068=06b68a25316d8ff9f51895ed4aac0a66d13f72913c65ce059cc46398b20232fe175923cc178a9e4dfa164873a630624c current_0069=06b68a25316d8ff9f51895ed4aac0a66d13f72913c65ce059cc46398b20232fe175923cc178a9e4dfa164873a630624c equal=true.
MIGRATION_CONTROL embedded_versions_unique=true; repair executes before migrator.run under the state-runtime startup lock.
TEST_CONTROL added_positive_pr528_recovery=1 added_unique_version_test=1 added_negative_unknown_checksum=0.

P1 BLOCKER — required migration compatibility gate is absent: the candidate adds no deterministic negative regression that seeds an unknown/malformed/mismatched version-68 checksum, invokes the real startup path, and proves the row is left untouched and startup rejects it. The only positive legacy fixture clones the current embedded 0069 migration and changes its version to 68, so the fixture and repair guard derive from the same mutable checksum rather than independently pinning the known PR #528 artifact. This fails the explicit fail-closed regression requirement for a function that mutates _sqlx_migrations.

RUN_CONTROL SDK 31342729444 head=07bfb452 status=completed conclusion=success; CLI 31342729483 head=07bfb452 status=completed conclusion=success; rust-ci 31342729504 head=07bfb452 status=completed conclusion=success. Remaining dependencies: Bazel 31342729506 head=07bfb452 status=in_progress; exact-main rust-ci-full 31341543610 head=90582651 status=in_progress.

Focused remediation only: add the exact negative checksum regression and independently pin/verify the PR #528 checksum fixture; same reviewer handles at most two remediation cycles.

[andrei-hasna]

[REVIEW] GO — #534 @ 07bfb45 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Reviewed the exact candidate against fresh origin/main at 905826510829d1456423f45fc67d329cae3dd33c.

What I ran and read:

• git log --oneline origin/main..HEAD — exit 0; three candidate commits read.
• git diff origin/main...HEAD --stat — exit 0; 2 changed files, 150 insertions.
• Full diff plus surrounding source for codex-rs/state/src/migrations.rs and codex-rs/state/src/runtime.rs — exit 0.
• Compared the PR Persist provider profile dispatch leases #528 version-68 usage-profile migration bytes with current version 69 — exit 0 for both object reads and byte equality confirmed.
• Read the runtime startup-lock acquisition, SQLite open/migration path, migration inventory helpers, and adjacent migration-upgrade tests.
• Read package.json — exit 0. This repository declares no typecheck script and no test script. Therefore it declares no local test gate; I did not invent one.
• bun install — exit 0; setup only, 521 packages installed. This is not reported as a test gate.
• gh pr view 534 --repo hasna/codewith --json statusCheckRollup — exit 0. Safe projected result: 28 checks total, 25 SUCCESS, 3 SKIPPED, 0 failed, 0 pending.

Authoritative forge checks read by name:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings: none.

The migration repair is reachable only for a version-68 row whose checksum exactly matches the historical PR #528 usage-profile migration. Those historical SQL bytes equal the current version-69 migration bytes. Under the existing startup lock, the repair re-stamps that row to 69, then the normal migrator applies the retained thread-monitor migration at 68. Fresh databases, current version-68 monitor stamps, unrelated rows, and checksum mismatches do not satisfy the update predicate.

Non-blocking follow-up:

• P2 test hardening: independently pin the historical PR Persist provider profile dispatch leases #528 checksum and add an unknown-checksum negative regression proving the row remains unchanged and startup rejects it. The current exact-checksum predicate is correct and the historical bytes were independently verified, so absence of this extra regression is not a reachable P0/P1 defect and does not block this PR.

[andrei-hasna]

[REVIEW] GO — Fable 5 fixed reviewer f4d54596. Exact head 07bfb45, tree 65b3ded13b4e9cdf5d66fb98d720f6f5966dd1a2; current main and PR base 9058265. Hosted rollup: total=28 pending=0 failed=0, all required CI SUCCESS. Acceptance passed: duplicate versions are rejected; canonical state migrations remain 68 thread-monitor and 69 usage-profile; the PR #528 legacy stamp is repaired only on exact checksum match while unknown divergence hard-fails; fresh and normal initialization remain valid; zero reachable in-scope P0/P1 defects remain. Non-blocking: unrelated migrator guard widening, a narrower negative-test refinement, and optional checksum constant pinning.

[andrei-hasna]

[REVIEW] GO — #534 @ 4485ffb — lens: correctness+security+gates, reviewer Trebius (1 of 1)

This replaces my stale GO for 07bfb452e724b60a1fa6fde582a4a05b7063402c. I reviewed the focused remediation commit 4485ffb4c test(state): pin migration repair guards and the resulting full candidate against current main at 905826510829d1456423f45fc67d329cae3dd33c.

What I ran and read:

• Original candidate history, stat, full diff, and surrounding runtime/migration source — exit 0.
• git log --oneline 07bfb452e724b60a1fa6fde582a4a05b7063402c..4485ffb4c917ff3d11f5581a45bb113a84e65b09 — exit 0; one focused remediation commit.
• Focused new-head diff stat and full diff — exit 0; runtime.rs plus the archived PR Persist provider profile dispatch leases #528 SQL fixture.
• Read new-head runtime repair constants, exact-checksum mutation path, positive and negative migration tests, and codex-rs/state/BUILD.bazel resource wiring — exit 0.
• Read the historical PR Persist provider profile dispatch leases #528 migration at pinned commit bae61b1418b9069145b82303c9f0c1d5929266f9 and the new fixture — both exit 0; byte comparison exit 0; SHA-384 equals the pinned constant.
• bun install — exit 0; setup only, 521 packages installed. It is not a test gate.
• Read package.json — exit 0. The repository declares no typecheck script and no test script, so it declares no local test gate. I did not invent one.
• gh pr view 534 --repo hasna/codewith --json headRefOid,statusCheckRollup — exit 0 at exact head 4485ffb4c917ff3d11f5581a45bb113a84e65b09; 28 checks total, 25 SUCCESS, 3 SKIPPED, 0 failed, 0 pending.

Authoritative forge checks read by name:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings: none.

The remediation independently pins the historical checksum and fixture, proves the archived bytes match the pinned PR #528 object, and exercises the real startup path with an unknown version-68 checksum. The negative regression verifies startup rejects the mismatch and preserves the migration row byte-for-byte. Bazel compile data already includes src/runtime/fixtures/**.

Non-blocking follow-ups: none introduced by the focused remediation.