[Brooooooklyn]

Fixes #664

Migration 0063 (OAuth refresh tokens, #631) shipped without rollbackSafeFrom edges for releases on the 0000–0062 schema. Without them, a 1.3.0, 1.4.0 or 1.5.0 platform cannot upgrade to the next release:

platform: Void Platform 1.5.0 cannot safely roll back after migrating database schema 8bde0b5b… to this release.

Change

compatibility.json  rollbackSafeFrom
  + { 1.3.0, 8bde0b5b… }
  + { 1.4.0, 8bde0b5b… }
  + { 1.5.0, 8bde0b5b… }

8bde0b5b… is computed from each release tag's journal and SQL with the runtime build's formula. The same script reproduces the existing 1.2.1 edge (d8e007d2…).

Why the edge is safe

0063 only creates oauth_refresh_tokens, and its foreign key to oauth_grants deletes on cascade. 1.3.0, 1.4.0 and 1.5.0 have identical OAuth code and never read the new table.

Older runtime action on the new schema	Result
create / revoke a grant	works as before
hourly purge of expired grants	works; refresh tokens of purged grants go with them
delete a user	works; grants and refresh tokens cascade
client disable, suspension, logout	sets fields the new refresh path checks

What a rollback costs. After rolling back to 1.3–1.5, connected apps cannot refresh, since the older /oauth/token only accepts authorization codes, so they reconnect. The older /oauth/revoke matches only access tokens, so a refresh token revoked during the rollback stays valid after you upgrade again, until the older hourly purge removes its grant, roughly a day later. 1.1.11 through 1.2.1 have the same revoke code, and main already lists them as safe for 0063.

Verification

• Ran the CI schema-compat steps locally against Postgres 18 for each of v1.3.0, v1.4.0, v1.5.0: migrate with the tag, seed, migrate with this branch, verify the seeded data, then run the tag's 106 API integration files on the upgraded schema.
  • 100–101 of 106 files pass. The failing files are all email-destination tests.
  • On v1.5.0, those same files fail the same tests on its own schema, without 0063. So they are local-environment failures, not caused by the migration.
• New unit test in admin-upgrade-compatibility.test.ts: checks the three edges, then applies 0063 with PGlite and runs the older runtime's grant insert, revoke, hourly purge SQL and user delete. It fails without the edges.
• vp run test --base origin/main: 219 files, 4,515 tests pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T14:08:43.471310Z	cc40808	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-rollback-edges-0063-void-cloud.voidzero-docs.workers.dev (commit cc40808)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://c0806f90-void-cloud.voidzero-docs.workers.dev	cc40808	2026-11-02T14:09:42.956Z	Visit the dashboard ↗