The cleanup step deletes any file the shipped manifest does not list outside
the protected prefixes. A SQLite database kept under database/ (a path the
installer accepts) is user state that can never appear in a manifest, so an
update destroyed it. The keep-list now always includes the resolved database
file of every in-installation SQLite connection, plus its -wal/-shm/-journal
side files. Found by the 3.0.0-alpha.2 -> alpha.3 upgrade rehearsal.
A single consolidation migration replaces the 150 removed historical files.
It decides — from reads alone — whether to build the boundary schema fresh,
skip on a fully-migrated 2.x database, or refuse a partial or inconsistent
history untouched. Fresh installs run it first and the live v3 chain after;
pre-2.x installs are directed through the latest 2.x release. The same
verdict backs a self-updater preflight so an unsafe upgrade is refused
before any file is copied. Schema verified identical to the boundary
fixtures on SQLite, MariaDB and PostgreSQL.
Full rewrite of the installer (incl. the finish step), self-update pipeline,
settings store, cron webhook, dashboard/bootstrap surface, environment
manager, wizard login, config endpoint and shared helpers. Byte-compatible
public interfaces and observable behavior, including documented legacy
quirks; verified by the pilot behavioral suite and the full test suite.
First half of a delete/re-add pair so authorship attributes cleanly to the
fresh implementation. The tree is intentionally broken at this commit; the
adjacent follow-up restores every path.
Darko Gjorgjijoski