0.1.0: prove upgrade from v0.0.5

[suraciii]

Goal

Prove and preserve the upgrade path from the latest public version, v0.0.5, to v0.1.0.

Problem

The exact v0.0.5 SQLite Reminder schema uses entity_type and entity_key. The current candidate migration fixture uses the new grain_type and grain_key names. A real v0.0.5 database can therefore fail before the candidate creates the new Reminder index.

The current external release proof starts only candidate-version processes. It does not prove an upgrade from the latest public version.

Scope

• Migrate the exact v0.0.5 Reminder columns to the v0.1.0 schema.
• Preserve State, Reminder, and Member data during the migration.
• Use a real v0.0.5 process to write a clean temporary database.
• Use the candidate, and later the exact v0.1.0 tag, to read and update the same data.
• Document the required generated-code and public API migration.

Acceptance

• The old-schema fixture matches the exact v0.0.5 tag.
• Migration is transactional, repeatable, and fails on an unsupported mixed schema.
• External proof resolves exact v0.0.5 without a local replacement.
• Candidate and tagged modes both run the same upgrade proof.
• Process coordination uses observable readiness and no fixed sleep.
• A mutation that removes the legacy-column migration fails focused proof.
• make external and make ci pass.

References

• design/release.md
• design/release-0.1.0.md
• docs/compatibility.md
• docs/release-0.1.0.md
• store/sqlite.go
• store/migration_test.go
• examples/shadow/cmd/conformance/external_release_test.go

[suraciii]

Local reviewed batch complete.

Commit: 66ba16047adbca5d74dfc2f8534471d794e2d07b
Base: 4cb95eaf778efcbaefb010f043066dfa070ee277
Branch: release-0.1-issue115-upgrade-proof
Worktree: /home/szf/.herdr/worktrees/gor/release-0.1-issue115-upgrade-proof

Implemented:

• Match the exact v0.0.5 Reminder schema and rename entity_type / entity_key inside the coordination initialization transaction.
• Reject mixed or incomplete identity columns without leaving schedule_version or member behind.
• Build a writer from exact v0.0.5 without a replacement. It uses the old public Shadow Application and generated package, writes State and a far-future Reminder, and closes normally.
• Open the same database with the candidate process, compare full persisted State, update State, and prove a forced restart. The test process uses the candidate Store code to directly read and compare the migrated Reminder and Member values.
• Add the upgrade proof to both make external and make external-tagged and document the source migration and regeneration steps.

Evidence on the exact commit:

• Focused migration proof: pass; 0.379 seconds for the final three-test selection.
• Focused external upgrade proof: pass; exact source v0.0.5, candidate target v0.0.0.
• Targeted mutation: replacing both identity renames with a no-op made both durability tiers fail with no such column: grain_type, exit 1. Restoring the implementation made the same test pass in 0.278 seconds.
• make external: exit 0, 48.99 seconds; 4 release command contract tests, 1 Quick Start process test, and 20 external module tests. UpgradeProof passed in 21.13 seconds.
• make ci: exit 0, 57.12 seconds; normal 637, race 637, simulation 20, generator 19, Transport network 45, Shadow network 49, resource 1 + 1, and three focused fuzz tests.
• Final worktree: clean at the full commit above.

Independent review first found the 30-second Reminder race, port reservation TOCTOU, partial coordination bootstrap, and incomplete persisted-value comparisons. The implementation now uses a far-future Reminder, an OS-selected port reported by readiness, one initialization transaction, and exact State / Reminder / Member comparisons across the candidate process and candidate Store reads. The follow-up review found no remaining P0, P1, or P2 issue in this batch.

Boundary: this is local-only proof. The branch is not pushed and no PR is open. Keep this issue open until the commit reaches remote master; hosted platform proof, final same-commit proof on master, and make external-tagged against the published v0.1.0 tag remain open.

[suraciii]

Completed in the integrated candidate #116. The fixture matches exact v0.0.5; migration renames legacy Reminder identity transactionally, rejects mixed schemas, preserves data, and is covered by a killing mutation. make external builds the writer from exact v0.0.5 without replacement and uses observable readiness to prove candidate read, update, and restart. Exact master 0c41f9f644905183d7d4fd8f7efed24e4396bf0d passed local make external with 20 tests and local/hosted make ci. Tagged mode is contract-tested to run this same proof; the actual post-tag make external-tagged execution remains open in #109 because v0.1.0 does not yet exist.