feat(data): add transactional canonical schema rename

[seonghobae]

Buyer and operator outcome

Refs #433. This stacked slice follows #500 and turns the reviewed migration-generation ledger into an executable SQLite cutover primitive. It remains Draft and intentionally unintegrated with startup/runtime until the parent is protected-shipped and the rename transaction can be reconciled to that exact protected head.

Exact stack

• parent: refactor/schema-migration-ledger-433@9f2e6818940c749380e6458b509c5f655a2670ca (feat(data): add fail-closed schema migration ledger #500)
• current contributor head: 81072df8f4dd2e2df269710eb7cc852312ff7543
• current tested PR merge: 2927e682b0d6ee87998053505d83faa82a398d5d
• child branch: feat/schema-canonical-rename-433

Any parent or child movement invalidates revision-sensitive evidence until fresh refetch.

TDD and repair evidence

The slice started RED by registering tests/unit/schema-canonical-rename.test.mjs before the production module existed. Hosted Server Tests run 33139011439 failed at the intended first boundary with ERR_MODULE_NOT_FOUND for server/schema_rename.mjs.

The production repair then added runCanonicalSchemaRename() with:

• all ten issue refactor(data): migrate single-word database objects with zero-downtime compatibility #433 table renames in one owned BEGIN IMMEDIATE transaction;
• PRAGMA foreign_keys = ON and legacy_alter_table = OFF enforcement;
• populated-row preservation and SQLite foreign-key target rewriting;
• canonical migration-ledger transition in the same transaction;
• foreign_key_check and integrity_check before commit;
• complete rollback after a post-BEGIN cutover failure;
• idempotent verification of an already canonical generation; and
• no rollback of a caller-owned transaction when BEGIN IMMEDIATE itself cannot start.

The first hosted implementation run exposed a test-representation defect: node:sqlite rows have a null prototype, so strict object equality failed although the returned values were correct. The regression was repaired by normalizing database rows to plain objects; production migration behavior was not weakened.

The current head further strengthens fail-closed coverage for missing foreign-key pragma evidence, inability to disable legacy ALTER TABLE mode, canonical-state foreign-key and integrity violations, and rollback failure while preserving the original causal cutover error.

Current-head hosted evidence for contributor head 81072df8f4dd2e2df269710eb7cc852312ff7543 / PR merge 2927e682b0d6ee87998053505d83faa82a398d5d:

• Server Tests run 33140351886: GREEN (unit-and-api, cloud-e2e);
• the job log records checkout of synthetic merge 2927e682b0d6ee87998053505d83faa82a398d5d, whose commit message binds child head 81072df8f4dd2e2df269710eb7cc852312ff7543 to parent 9f2e6818940c749380e6458b509c5f655a2670ca;
• all eleven canonical-rename regressions pass, including populated/FK preservation, idempotence, FK fail-closed behavior, mid-cutover rollback, adapter validation, caller-owned transaction preservation, missing pragma evidence, legacy ALTER TABLE enforcement, canonical integrity failures, and causal-error preservation when rollback itself fails;
• Dependency Review run 33140351742: GREEN;
• OSV Scanner run 33140352091: GREEN.

The hosted checkout above is the synthesized PR merge, not the contributor head itself. It is valid integration/product evidence but is not represented here as corrected exact-contributor-head merge authority.

package.json includes server/schema_rename.mjs in the owned c8 coverage surface and includes the rename regression in coverage cases. Exact 100% owned production coverage remains an explicit merge gate and is not inferred from the Server Tests workflow.

Scope boundary

This PR does not wire canonical tables into application startup or application queries and does not close #433. Runtime query migration, compatibility-view decisions, PostgreSQL parity, backup/restore rehearsal, deployment cutover and final rejection of remaining single-word owned production database objects remain later bounded work.

Merge gate

Keep Draft and do not merge independently of #500. Merge is prohibited until the parent is protected-shipped, this child is reconciled to the resulting protected head, every applicable exact-head test/browser/owned coverage/docstring/security/dependency/supply-chain/package/provenance/migration-recovery gate is terminal-passing under corrected checkout controls, valid unresolved findings are zero, and a qualifying independent current-head approval exists under live governance.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}