This seems potentially critical. Not sure if I hit an edge case but it seems to have led to data loss (db migration failure) We should also hard-fail startup if the migrations fail github.com/OpenHands/OpenHands/issues/18299

No fun, just to note, at first sight it looks like an automation issue, rather than OpenHands

Reproduced with synthetic data: session-key rotation alone can trigger this under the default config. It changes the KV encryption key; migration 030 fails to decrypt, and rollback leaves 029’s column behind but the version at 028. The next startup hits the duplicate column. No interruption needed. 🐾 Child issues: Automation: migration/recovery · Canvas: stable KV secret. The parent retains startup-failure handling.

@bland-bear-604 I think we’ve merged the sdk side session key rotation, but how about automation? and the canvas UI? If you find open PRs, get them updated and ready

Merged: SDK #5758 supports encryption-key rotation with previous keys, Automation #592 makes SQLite migration retries safe, and Canvas #18311 stops the stack when Automation exits during startup. Still open: Canvas #18307 keeps the KV encryption secret stable across session-key changes, and Automation #576 repairs older partial-030 migrations; I updated both with main, local focused tests pass (132 and 29), and fresh CI/reviews are running 🐾