Summary
The schema collapsed back to a single migration (V1) before the v1.0.0 release.
Migration is tested in the forward direction (fresh→V1, plus idempotent reopen),
but nothing covers the case of a binary opening a store whose user_version is
newer than the binary knows about — the realistic situation once the store is
an external-writer contract and a newer external tool has bumped the schema.
Evidence
musefs-db/src/schema.rs has MIGRATIONS = &[MIGRATION_V1] (latest = V1) and
migration tests cover fresh→V1 and idempotent reopen.
musefs-db/tests/schema.rs asserts a fresh DB is at user_version = 1 and
that reopen does not re-migrate.
migrate() returns early with success when user_version >= latest
(schema.rs:212), so a store at a newer user_version (e.g. V2 written by a
future/third-party tool) is treated as already-migrated and opened — there is
no "store is newer than this binary" guard, and no test asserts a defined
outcome for that case.
Risk
A future or third-party schema bump can cause an older binary to silently
misread the store rather than failing with a clear "store is newer than this
binary" error, directly affecting the external-writer contract.
Summary
The schema collapsed back to a single migration (V1) before the v1.0.0 release.
Migration is tested in the forward direction (fresh→V1, plus idempotent reopen),
but nothing covers the case of a binary opening a store whose
user_versionisnewer than the binary knows about — the realistic situation once the store is
an external-writer contract and a newer external tool has bumped the schema.
Evidence
musefs-db/src/schema.rshasMIGRATIONS = &[MIGRATION_V1](latest = V1) andmigration tests cover fresh→V1 and idempotent reopen.
musefs-db/tests/schema.rsasserts a fresh DB is atuser_version = 1andthat reopen does not re-migrate.
migrate()returns early with success whenuser_version >= latest(
schema.rs:212), so a store at a neweruser_version(e.g. V2 written by afuture/third-party tool) is treated as already-migrated and opened — there is
no "store is newer than this binary" guard, and no test asserts a defined
outcome for that case.
Risk
A future or third-party schema bump can cause an older binary to silently
misread the store rather than failing with a clear "store is newer than this
binary" error, directly affecting the external-writer contract.