Context
Surfaced during #287 (Dashboard v1 Phase 5) review.
The legacy-migration marker (src/workspace/legacy-migration.ts) keys on raw store-record existence (store.read() !== null), while WorkspaceRepository.loadCurrent() (src/workspace/workspace-repository.ts) deliberately treats an undecodable record as null (a corrupt aggregate is not returned as if valid).
Effect
A corrupt-but-present StoredWorkspaceV1 record:
- permanently blocks re-migration (the marker sees "exists"), and
- makes
loadCurrent() return null, so app.loadWorkspaceOnBoot projects nothing and the session silently continues on the createState() legacy projection with a fresh placeholder workspaceId;
- the next successful CRUD commit then writes a brand-new aggregate that orphans the corrupt record — with no user-visible error that recovery failed or data may have been dropped.
Narrow (requires a corrupted IndexedDB record), and no data is silently lost from what's visible (the flat legacy keys are never deleted), but the failure is silent.
Proposed
Surface a toast/diagnostic when loadWorkspaceOnBoot finds a present-but-undecodable aggregate (distinguish "no aggregate yet" from "aggregate unreadable"), and offer an explicit recover/reset path rather than silently minting a new workspace over the corrupt record.
Context
Surfaced during #287 (Dashboard v1 Phase 5) review.
The legacy-migration marker (
src/workspace/legacy-migration.ts) keys on raw store-record existence (store.read() !== null), whileWorkspaceRepository.loadCurrent()(src/workspace/workspace-repository.ts) deliberately treats an undecodable record asnull(a corrupt aggregate is not returned as if valid).Effect
A corrupt-but-present
StoredWorkspaceV1record:loadCurrent()returnnull, soapp.loadWorkspaceOnBootprojects nothing and the session silently continues on thecreateState()legacy projection with a fresh placeholderworkspaceId;Narrow (requires a corrupted IndexedDB record), and no data is silently lost from what's visible (the flat legacy keys are never deleted), but the failure is silent.
Proposed
Surface a toast/diagnostic when
loadWorkspaceOnBootfinds a present-but-undecodable aggregate (distinguish "no aggregate yet" from "aggregate unreadable"), and offer an explicit recover/reset path rather than silently minting a new workspace over the corrupt record.