Lab #3117: datastore config migrate writes its sentinel before pushing; after a failed push a re-run reports 'already completed' and never publishes

Summary

swamp datastore config migrate writes its "already migrated" sentinel (config/managed-config-migrated.json) into the local cache before it pushes to the datastore. If the push fails, the command exits non-zero, but every re-run finds the local sentinel, reports alreadyMigrated: true, exits 0 and pushes nothing. The datastore never receives the config, and nothing tells the user to run swamp datastore sync --push.

Where it happens (swamp `5517e708`)

src/domain/datastore/managed_config_migration.ts:
- :44-59: the "already migrated" check stats the sentinel in the local cache only.
- :129-135: after copying, the sentinel is written unconditionally, before returning.
src/cli/commands/datastore_config_migrate.ts:
- :126-181: the migration runs inside a root unit of work. The push runs only after the body has completed (pushWhen: "completed"), so the sentinel is already on disk when it starts.
- :153-161: the alreadyMigrated branch returns early. pushed stays false, so the root's push does nothing.
- :129-133: the push is a plain pushNamespace. Unlike other managedConfig writes since #2752, a failure is not wrapped in ManagedConfigUnpublishedError, so the user sees the raw sync error with no "Run 'swamp datastore sync --push' to publish it."

Recovery exists but is undiscoverable. The failed push leaves the cache marked as having unpushed changes, so an explicit swamp datastore sync --push, or any later config write such as model create, uploads the migrated files. Neither the error nor the "already completed" message says so.

Steps to reproduce

A repo on @swamp/s3-datastore (or @swamp/gcs-datastore) against a local emulator.
Make the emulator unreachable, for example docker compose pause.
swamp datastore config migrate: exits non-zero with the raw push error.
Restore the emulator, then run swamp datastore config migrate again. It prints "Config migration already completed" (--json: {"alreadyMigrated":true,"managedConfigSet":false}) and exits 0.
A second repo that joins the datastore and pulls finds an empty config tier. swamp model get <name> for a model the first repo migrated is not found.

This was found by reading the source. It has not yet been reproduced against a paused emulator.

Expected

A failed push leaves migrate re-runnable. Either:
- the sentinel is written (or published) only after a successful push; or
- a re-run checks the sentinel in the datastore, not only in the local cache, and pushes when the datastore does not have it.
A failed push fails the way other managedConfig writes do since #2752: non-zero exit, local copy kept, and a message that names swamp datastore sync --push.

UAT

swamp-uat will cover this in tests/cli/datastore/config/migrate_test.ts as part of swamp-uat#490. The test cuts the datastore during the first migrate, restores it, runs migrate again, and checks that a clone joining afterwards sees the migrated definitions.

Session-start 'swamp model search --json' in the AGENTS.md template is unfulfillable - wire it to a hook or drop it

Flaky property test: analyzeExpression dot/bracket agreement fails when the generated model name is a CEL keyword

Accept usernames for user subjects in grant files

Docs: enable-managed-config should say to re-run config migrate when its push fails

datastore config migrate checks the sentinel in the stale local cache and re-runs a full migration over a shared S3 datastore

datastore config migrate writes its sentinel before pushing; after a failed push a re-run reports 'already completed' and never publishes

extension quality, fmt --check and push disagree: bare-specifier severity, cache hit skips gates, gate failure hides the rubric, fmt ignores project config

Docs: grant file reference shows a stale format and omits resources and subjects

Docs: extension push dry-run reference and how-to need the registry checks, API-call list and content hash from Lab #3016

Flaky property test: analyzeExpression hyphenated dot access fails when modelName generates a CEL keyword ("in")

extension quality and push crash with IsADirectory when additionalFiles lists a directory

extension push: a required global argument renders with a stray "" ("text": "string""")

Resolve non-admin actors in dashboard audit logs

A nested structural swamp still waits on its run's lock when the lock holder is not a same-host ancestor (cross-host worker, --server into a non-ancestor serve)

Docs: extension publishing reference is stale on bare specifiers, quality output and fmt config (swamp-club#3022)

Docs: serve authorization page should cover expression-reference checks and the vault.get trust boundary

swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions

Docs: channel-aware extension push prompts and promote with a manifest (follow-up to #2939)

extension push: 'Requested visibility' line prints to stdout without the logger prefix, twice per run

A nested structural swamp that outlives the run that started it keeps skipping that run's lock while the holder writes

Show signal waits to remote clients and the dashboard

Settle expired signal waits from swamp serve

Resume signalled workflow runs automatically under swamp serve

extension push/quality: structured acceptances for agents, a clearer title than For next time, and an optional reason

Deliver workflow signals through a write-once outcome record instead of writing the run record

Shell steps: a vault.get on a continuation line of a multi-line double-quoted string inside a here-doc is wrapped in quotes

extension push: testing-completeness warns once per generated model (262 warnings in 25 extensions) with no way to mark a package generated

extension push: declare accepted lint warnings where the finding is (inline swamp-review-ignore comments, a sidecar review file beside the manifest), reported in quality, push and the registry

Docs: manual describes the old extension push path resolution (manifest argument, --extensions-dir scope, global skill fallback) after swamp-club#3018

extension push: --extensions-dir is ignored for bundled workflows

extension push: sub-directory extensions cannot be found from outside their directory (manifest path, directory argument, --extensions-dir for workflows and skills)

GCP bigquery datasets update cannot target the dataset: reads the id from a name field datasets do not have

extension push: the undecided private-entitlement verdict still says the registry may start a trial at publish

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

Replayable state fragments: Git-reviewable desired state for resources changed by model methods

Extension bundler rewrites zod import text inside string/template literals, breaking code-generating extensions

s3-datastore: pull never removes files deleted on the remote, so a peer's next push re-uploads them and undoes `swamp data gc`

swamp-testing withMockedCommand: record env and cwd in CapturedCommandCall

Forward held-lock identity over --server so a loopback nested swamp does not wait on its caller's lock

extension push: registry metadata and content hash label files relative to the repo dir, so a push with --extensions-dir records ../ paths

Share dashboard authentication across tabs for deep links

Docs: vault.get shell references are placed per occurrence, and every single-quoted use is warned about

A nested structural swamp on a same-host remote worker waits on its own step's lock held by swamp serve

Scheduled flaky-test detection is failing

Docs: declared acceptances for extension push warnings (quality.yaml sidecar, swamp-quality-ignore comments, For next time report)

Docs: describe the private-entitlement registry check and the refusal wording in the extension publishing reference

Fail fast when nested structural commands under parallel runs wait on each other's locks

Use whoami entitlement to explain private-extension push refusals

registry: store and show declared acceptances sent in contentMetadata.acceptances at confirm (swamp-club#3021)

@swamp/digitalocean/space-key: update and sync call /v2/spaces/keys/undefined

Relationships

#3117 datastore config migrate writes its sentinel before pushing; after a failed push a re-run reports 'already completed' and never publishes

Summary

Where it happens (swamp 5517e708)

Steps to reproduce

Expected

UAT

Shipped

Where it happens (swamp `5517e708`)