Expand description
Repair db_accounts.secret_ref rows whose JSON was corrupted by an
out-of-band edit of the shared store — found live: a raw Windows path
pasted into the JSON string with its backslashes never escaped
({"backend":"oauth_config_dir","dir":"C:\Users\..."}, valid JSON needs
\\ per separator). Not reproducible from any write path in this
codebase (Store::identity_upsert always serde_json::to_strings
correctly) — see
ANALYSIS_ARMORY_STASH_CREDENTIAL_VISIBILITY_GAP_2026_08_04 (never committed to this repo)
§7 for the full incident.
Global-scoped (touches the shared store directly, like
m0012_dedup_identity_accounts and m0018_ambient_login_registry). Safe
to re-run: identity_repair_malformed_secret_refs is a no-op once every
row parses.
This migration is a data repair, not a substitute for
identity_list/identity_get’s own per-row tolerance (see the same
analysis doc’s §6 option 1, implemented alongside this migration in
backend/storage/identities.rs) — the two are independent defenses:
this fixes the one known-bad row; that keeps any future corruption from
ever again hiding every other account.