jschoubben
b4607dfc03
Decided after measuring what renumbering actually costs: 96 references in code comments across two repositories, none of which would have failed to compile. They would have pointed at the wrong reasoning, which is worse than a broken link because nothing reports it. So a number identifies a record and never changes. It cannot also be a position -- a position moves when the set changes, and an identity that moves is not one. The reading order moves into an index generated from each record's `topic:`. Six topics, in the order somebody learns the system. The index is WRITTEN rather than only generated on demand, which reverses what this repository previously said. The reason it said otherwise is that a hand-written index drifts -- but a reader looking at the folder on a forge sees the folder, not a command, and the drift objection is answered by checking rather than by refusing to write one. That is §5's own rule: a rule states how it is checked. Two checks, both confirmed to bite. index.py fails when the written order no longer matches the records. records.py fails when a record has no topic or one nobody defined -- the quiet failure being a record that vanishes from the order rather than appearing in the wrong place.
3.2 KiB
3.2 KiB
topic, status, date, deciders, reconstructed
| topic | status | date | deciders | reconstructed |
|---|---|---|---|---|
| building it | accepted | 2026-05-14 | jochen | true |
13. Schema and state changes are numbered migrations, in the same language as the code
Reconstructed after the fact from the evidence cited below.
Context
Modules own persistent state. That state has to change as they change, across nodes that are at different versions, some of which have data that predates the change.
Two things were being done that do not survive contact with a second node. Schema was created at startup, so what a table looked like depended on which version last started. And migrations were shell scripts, so they could not use the types, connection handling or helpers the module already had, and were not compiled or checked with it.
Considered options
- Startup SQL / create-if-missing. Rejected. It converges only for a node that started with the newest version. A node that never restarts never migrates; a node that restarts on an old version can undo a change.
- Shell migrations. Rejected. Unchecked, untyped, and a separate dialect from the module they belong to. Also, as later discovered, packaged differently — and therefore occasionally not packaged at all.
- Numbered migrations in the module's own language, compiled with it. Chosen.
Decision
Every schema or state change is a numbered migration file, written in the same language as the module and compiled with it. There is no startup schema creation and no ad-hoc statement.
Rules that come with it:
- The initial migration is frozen once it has run anywhere. It is never modified; a change is a new number.
- Every statement is idempotent — guarded so that re-running is safe.
- A change needs both a baseline for a fresh installation and an incremental migration for installations that already exist. Code referencing a column requires that the migration creating it exists.
- Migration numbers are unique. A duplicate prefix is a defect, not a style issue.
Consequences
- A node at any version converges to the current schema by running the migrations it has not run.
- Migrations are checked by the same compiler as the code, and a migration that does not compile fails the build rather than the deployment.
- The rules are enforced unevenly. Duplicate prefixes have shipped repeatedly and been fixed by renumbering afterwards; the mesh now validates for them, which is the check this rule needed in order to be real.
- A migration directory is a feature like any other, which means it is packaged like any other — and when packaging is wrong, migrations silently do not ship. This has happened.
- Freezing the initial migration means a fresh installation replays the entire history. That cost grows and nothing currently bounds it.
References
fix(agents): convert workflow migrations to TypeScript(#50), 2026-05-14.feat(dev_validate): guard against duplicate migration numeric prefixes(#379), 2026-06-26 — the rule acquiring a check.- Knowledge base:
migrations/schema-drift,noxflow/troubleshooting/migration-number-collision. - Packaging failures:
troubleshooting/shell-migrations-never-packaged,troubleshooting/provision-migration-never-applied.