`msb start` fails on sandboxes created before 0.7.0: "substitution.basic_auth cannot be preserved"

Summary

After upgrading from 0.6.x to 0.7.2, every sandbox created under 0.6.x with any --secret binding fails to start. The 0.7 persisted-config migration misses two renamed/removed fields from #1356. There is no documented migration path; only msb rm + recreate works.

Environment

• macOS 26.7, arm64 (HVF)
• msb 0.6.18 (release tarball) to create, msb 0.7.2 (Homebrew tap) to start
• Reproduced in an isolated MSB_HOME

Reproduce

export MSB_HOME=~/.cache/msb-repro TOKEN=x
msb-0.6.18 create --name repro --secret [email protected] alpine
msb-0.6.18 stop repro
msb-0.7.2 start repro

Actual

error: invalid config: unsupported persisted sandbox configuration: field config.network.secrets.secrets[0].substitution.basic_auth cannot be preserved

0.6.18 persists this for a bare --secret ENV@HOST (no options):

"injection": { "headers": true, "basic_auth": true, "query_params": false, "body": false }

Cause

#703 planned to drop basic_auth and query_params from the secret substitution schema, and #1356 (0.7.0) shipped it: basic_auth is folded into headers and query_params is renamed to query. The persisted-config migration in sdk/rust/lib/db/config.rs only renames injection -> substitution and on_violation -> violation_action. The preserve_values round-trip check then rejects the config on the first field it can't map.

Verified by editing the persisted JSON in db/msb.db directly:

• Remove basic_auth: start now fails on substitution.query_params cannot be preserved.
• Also rename query_params -> query: msb start succeeds on 0.7.2.

So the migration needs two more steps per secret entry: drop basic_auth and rename query_params to query.

Expected

Sandboxes created on 0.6.x start on 0.7.x with Basic auth still substituted under headers, which is what #1356 describes as the new behavior anyway. If a recreate were genuinely required, the release notes and docs/changelog should say so; currently the Aug 26 entry says "Existing sandboxes keep their saved configuration" and the Sep 4 entry says upgrades from earlier releases work again.

Workaround

msb rm <name> and recreate on 0.7.x. Named volumes and bind mounts survive; the root disk does not.