Retained-data upgrade to 0.29.16
0.29.16 reads retained releases and adds conversation storage at SQLite schema 8. JSON stores remain version 4, and archive.db remains schema 1. Existing jobs, ownership history, native thread IDs, grants, configuration and pairing keys survive. Interrupted jobs can be continued by their actual supervisor or project master. Claude Code, Codex, opencode and Antigravity share this path.
The release publishes tagged code and green CI. The owner installs all clients together; the release agent never installs or updates local clients.
Upgrade and rollback
Section titled “Upgrade and rollback”The primary SQLite chain takes a verified, consistent snapshot before its single
publication transaction. Snapshot and DDL share an exclusive migration lock.
Intermediate migration versions are uncommitted: a reader sees the old version
until the entire transaction commits. An exception or killed writer leaves the
old schema and records usable. Protected originals remain in
.migration-snapshots; legacy discovery copies and archives are also retained.
Each JSON format publication first copies the complete old bytes to a unique
backup, fsyncs its replacement, then atomically renames it. Unknown fields survive.
A second run does not create another schema snapshot or change JSON bytes.
For rollback, retain the captured old binaries and their complete pre-upgrade data snapshot. Stop writers before restoring a backup into a new home; verify its integrity before selecting it. Do not overwrite or remove the newer home. Old binaries must never be pointed at an already published future format.
Live readers advertise their actual format ceilings. 0.29.14/15 understand JSON 4 and SQLite 7. A new session can communicate through the older broker; schema 8 publication defers until readers that cannot understand it finish. No process is stopped for an update and old plugin directories remain intact.
Historical matrix
Section titled “Historical matrix”Captured synthetic states were generated by executing the actual released writers from isolated Git-tag sources: 0.27.0, 0.27.1, 0.28.0, 0.28.1, 0.28.2, 0.29.0, 0.29.10, 0.29.13 and 0.29.14. Fixtures record the tag SHA and file/table SHA-256 provenance. They include available primary/archive schemas, JSON stores, config, jobs, runs/logs, worktree metadata, network pairing and pending approvals. A feature absent in an old release is recorded as absent, rather than manufacturing a newer layout. Pairing secrets are synthetic.
upgrade-json-matrix.test.ts preserves every original field, exact original
backup, log, pairing and approval byte sequence and tests repeat writes. It also
checks retained native sessions, config readers and project-local exclusions.
The historical SQLite matrix verifies original columns, counts and row-content
hashes, including Unicode, BLOBs, unknown extensions and archive metadata.
Full startup additionally verifies readable messages after legacy archive movement.
migration-interruption.test.ts injects failures and kills actual SQLite/JSON
writers before publication, verifies the complete pre-publication backup and
old-reader visibility, then retries idempotently. mixed-release-processes.test.ts
starts the real 0.29.14 MCP artifact with the current worker: versions are checked,
both directions deliver mail on schema 7, and schema 8 appears only after the old
reader exits. CI fetches release tags so this check runs on every platform.
Owner-data copy audit, 2026-10-07
Section titled “Owner-data copy audit, 2026-10-07”The final version-16 source also repeated the copy audit after integration. All counts and original-content hashes remained unchanged. This second capture included 4,662 retained files, including the first migration’s protected JSON backups; it published no additional SQLite snapshot and remained byte-idempotent.
Only a temporary copy was migrated. The original home and its live processes were not modified. The full home copy retained all bridge application stores; unrelated Unity compiler caches had access-denied errors and were left untouched. Physical project checkouts and caches are outside this migration. Worktree metadata inside job/run records is covered by original-field hashes.
SQLite inputs were individually consistent read-only snapshots, including committed WAL contents; raw file/WAL captures were kept separately. JSON/log captures are individual file sequences, not a global transaction across live stores. The audit never starts a broker, invokes approval callbacks, ingests native histories or creates mirrors at paths recorded in owner data. A new project mirror is additive; the historical tests verify local Git exclusion without editing tracked ignores.
All following before → after counts and original-content hashes match:
| Store/table | Before | After |
|---|---|---|
| bridge messages | 21,221 | 21,221 |
| bridge archived messages | 0 | 0 |
| decisions / decision deliveries | 0 / 0 | 0 / 0 |
| history documents / FTS rows | 79,070 / 79,070 | 79,070 / 79,070 |
| history cursors / files | 10,193 / 9,433 | 10,193 / 9,433 |
| history sessions / tags | 386 / 164,509 | 386 / 164,509 |
| history pending | 0 | 0 |
| FTS config / data / docsize / idx | 1 / 11,985 / 79,070 / 7,563 | 1 / 11,985 / 79,070 / 7,563 |
| job delivery routes | 184 | 184 |
| peer name owners / names / bindings | 225 / 58 / 46 | 225 / 58 / 46 |
| archive.db messages | 178 | 178 |
| resource slots / root limits | 7 / 6 | 7 / 6 |
| active jobs.json records | 217 | 217 |
| three retained jobs.json backups | 236 / 228 / 228 | 236 / 228 / 228 |
| archive files / records | 278 / 686 | 278 / 686 |
| job files | 1,511 | 1,511 |
| run files / other logs | 995 / 3 | 995 / 3 |
| approvals | 73 | 73 |
| network files | 3 | 3 |
| pairing identities / pairs / invitations | 1 / 1 / 0 | 1 / 1 / 0 |
| read-state files / records | 270 / 276 | 270 / 276 |
| message waits / session files | 26 / 1 | 26 / 1 |
| local result receipts | 80 | 80 |
Config, auto-wake preferences, model caches, notification state, dashboard state, the token and retained JSON backups also retain all original contents. In total, 3,254 bridge files were checked; 1,425 additive format writes preserved all original fields. Primary schema changed 7 → 8; archive stayed 1 → 1. All four databases passed integrity and foreign-key checks. Repeating the migration was idempotent. The detailed local audit contains every table’s count and SHA-256; it contains no message text, pairing keys or token contents.
Reproduction uses scripts/capture-upgrade-json.mjs for synthetic historical
captures and scripts/audit-upgrade-copy.ts for an explicitly named
owner-copy-* directory. Keep the copy and report; never run the audit on the
live home. The requested main-path alias E:\Development\claude-codex-comm
resolves to the real D:\Development\claude-codex-comm.