chore(pegboard): simplify v1 to v2 migration to not rely on sqlite

[NathanFlurry]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[NathanFlurry]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• chore(pegboard): simplify v1 to v2 migration to not rely on sqlite #4797 👈 (View in Graphite)
• fix(pegboard): move sqlite v1 migration into actor workflow #4787 : 1 other dependent PR (#4810 )
• test(rivetkit): cover c.db access from onWake/onSleep/onDestroy #4786
• fix(rivetkit-napi): run onMigrate before createState/onCreate/createVars #4785
• refactor(rivetkit-core): merge ready+started into lifecycle_started, drop redundant napi calls #4784
• fix(rivetkit): drain native sleep side tasks reliably #4782 : 1 other dependent PR (#4783 )
• fix(rivetkit): route raw request fetches to actors #4781
• fix(pegboard): refresh runner config after envoy connect #4778 : 2 other dependent PRs (#4779 , #4798 )
• chore(kitchen-sink): configurable endpoint #4766 : 2 other dependent PRs (#4754 , #4777 )
• refactor(rivetkit-core): rename StopReason to ShutdownKind and kill enum fallthroughs #4765
• chore(envoy-client): log command and event payloads #4751
• fix(rivetkit): minor sleep-cleanup follow-ups #4761
• docs(rivetkit): clean up stale setPreventSleep references in docs and JSDoc #4760
• docs(rivetkit): document keepAwake/waitUntil counter-arm race and surface bridge errors #4759
• test(engine): force overdue branch in alarm-during-sleep test with negative offset #4758
• fix(rivetkit-core): return stopping not starting when sleep/destroy called mid-shutdown #4757
• test(rivetkit): remove sleepWithPreventSleep fixture and tests #4756
• test(engine): add regression test for alarm-during-sleep-transition race #4755
• test(rivetkit-core): cover sleep/destroy guards and prevent_sleep no-op #4750
• docs: add keepAwake vs waitUntil table and internal sleep-sequence invariants #4749
• feat(rivetkit): expose c.keepAwake(promise) through native path #4748
• refactor(rivetkit): deprecate setPreventSleep to no-op in TypeScript #4747
• fix(rivetkit-core): enumerate non-drained counters in grace deadline warn log #4746
• fix(rivetkit-core): abort graceful cleanup task when grace deadline elapses #4745
• fix(rivetkit-core): error on sleep/destroy before startup or already-requested #4743
• fix(rivetkit-core): cap SerializeState shutdown timeout at 15s #4742
• refactor(rivetkit-core): remove prevent_sleep field and deprecate set_prevent_sleep to no-op #4741
• fix(api-public): remove orphan import_export actors module #4764
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: chore(pegboard): simplify v1 to v2 migration to not rely on sqlite

This is a solid cleanup. The start_new_generation refactor eliminates real duplication, moving rusqlite/tempfile to dev-dependencies is a meaningful production binary improvement, and the new metric makes the rejection path observable. A few items worth addressing before merging:

---

Medium: Silent no-op on missing pending stage post-write (commit.rs)

After the UDB write for a chunk completes, the in-memory stage is updated with two separate get_async calls:

// post-write success path
if let Some(mut entry) = self.pending_stages.get_async(&stage_key).await {
    let stage = entry.get_mut();
    stage.next_chunk_idx += 1;
    stage.saw_last_chunk = request.is_last;
}
// post-write error path
if let Some(mut entry) = self.pending_stages.get_async(&stage_key).await {
    entry.get_mut().error_message = Some(err.to_string());
}

Previously, Arc::clone was done once before the UDB write and the mutex was held for the full operation — the entry could not disappear. Now there is a TOCTOU window: if a concurrent commit_finalize removes the entry between the pre-write check (line ~498) and the post-write update (line ~597), the next_chunk_idx/saw_last_chunk/error_message update is silently dropped. CLAUDE.md's "Fail-By-Default Runtime" constraint explicitly calls out silent no-ops for required runtime behavior.

Options: (a) return an error if the entry is missing post-write, (b) hold the scc entry across the UDB write via entry_async to prevent concurrent removal, or (c) add a comment documenting why the silent drop cannot happen in practice (e.g., Gasoline serializes per-actor so there can be no racing commit_finalize).

---

Low: Removed journal auto-recovery — no operator runbook

The old code recovered from a pending journal sidecar by opening the SQLite file via rusqlite (which rolls back the uncommitted transaction automatically). The new code rejects the actor and emits SQLITE_MIGRATION_REJECTED_JOURNAL_TOTAL. This is observable, but there is no documented manual recovery path for operators when this counter is nonzero. Consider adding a note in the code comment or a .agent/todo/ entry pointing to what an operator should do.

---

Low: Weaker integrity guarantee after removing rusqlite

recover_v1_snapshot previously ran PRAGMA quick_check(1) after opening via rusqlite. validate_v1_main replaces this with header-only byte validation (magic bytes, page size, alignment). A database with a valid header but corrupt page data will now pass validation and be imported into v2. The test rejects_v1_main_with_corrupt_magic_byte pins the new path correctly, but there is no test for the valid-header/corrupt-page scenario. This is a deliberate trade-off given the PR title — just worth acknowledging explicitly, either in a comment or a follow-up issue.

---

Low: Concurrent migration race without in-process lock

The removed SQLITE_MIGRATION_LOCKS per-actor mutex prevented two concurrent callers from entering maybe_migrate_v1_to_v2 for the same actor simultaneously. The distributed-level lease check (MigratingFromV1 + lease_expires_at) still guards correctness, and Gasoline serializes per-actor workflow steps, so the in-process lock was redundant in practice. A brief comment explaining why the in-process lock is no longer needed (Gasoline serialization) would help future readers who might otherwise think it was accidentally dropped.

---

Style: Pre-existing inline #[cfg(test)] in engine.rs

engine/packages/sqlite-storage/src/engine.rs has an inline #[cfg(test)] mod tests block. CLAUDE.md requires Rust tests to live under tests/. This pre-dates this PR and isn't a blocker, but worth a follow-up.

---

What looks good

• start_new_generation extraction cleanly deduplicates three call sites with identical generation += 1 / migrate / SendOutbound sequences.
• rusqlite + tempfile moved to [dev-dependencies] — production binary no longer links SQLite.
• New SQLITE_MIGRATION_REJECTED_JOURNAL_TOTAL metric makes the failure mode observable.
• validate_v1_main header checks are clear and the magic-byte test pins the validation path.
• Structured tracing fields, complete-sentence comments, no _ => fall-throughs — all pass CLAUDE.md checks.
• V1File.size_bytes removal replaced with bytes.is_empty() — correct and simpler.

Concern	Severity
Silent no-op on missing pending stage post-write	Medium — should fix or document
No operator runbook for REJECTED_JOURNAL_TOTAL > 0	Low
Weaker integrity check (header-only validation)	Low
Concurrent migration race without in-process lock	Low — needs comment
Inline #[cfg(test)] in engine.rs	Pre-existing, not a blocker