change-persistence

Change Persistence

Classify the State

1. Decide whether the data is canonical durable state, a derived index/snapshot, cache, auth secret, runtime lock, temporary artifact, or project-local configuration.
2. Read Storage and paths and the owning architecture document.
3. Trace every writer, reader, index, event, export/import path, recovery path, deletion path, and startup migration before changing the shape.

Implement the Current Model

File-backed JSON

1. Build logical keys through StoragePath; use Storage for locks, atomic writes, reads, scans, and removal.
2. Keep independently updated or streamed records independently addressable. Do not rewrite a whole session or collection for one leaf update.
3. Update derived indexes and events in the same owner transaction/lifecycle as the canonical write.
4. Preserve the atomic-write transient-retry contract: Storage write+rename retries EPERM/EACCES/EBUSY (classified by isRetryableIOError) so Windows sharing violations do not fail persistence, permanent errors fail fast, and temp files are removed (with the same transient retry) on the failure path. Do not bypass Storage with a bare rename; extend test/storage/storage-retry.test.ts when changing write-path failure behavior.
5. Authoritative rollout evidence uses private, durable Storage writes and the bounded RolloutArtifact stream store. Keep progress independently committed, verify content hashes, and preserve partial observations. Do not replace its persistence failures with diagnostic warnings, empty data, or successful completion; propagate RolloutRecordingError so execution admission can stop.

SQLite and other domain stores

1. Keep fresh-install schema creation in the owning database initialization.
2. Put upgrades, backfills, and rewrites in versioned domain migrations registered through the central migration runner.
3. Preserve transaction, WAL, vector-extension fail-soft, and backup assumptions of the owning store.