Currently, there is nothing that prevent a store with an old schema to be migrated to a new schema but without applying the migration required on the data themselves, and to have it accessed by a recent core, that may simply corrupt the data.
This is due to several issues:
- regardless of the success of database migration, XWiki continue its startup and go live.
- when migration are disabled, the data version is never checked
- schema update is done at many (useless) places to ensure the latest schema is always use, but without any care about the need of data migration
- during schema update, some data migration queries are also applied
IMO, the best way to fix this all and be safe (even if we have broken code), is to check the current version of the database at the lowest possible level, during database switching, and ensure that access to this database is acceptable. This is almost what is done for schema update (even too much). Schema update should not be done independently, so it should be done during data migration.