cesnimda
4.2 KiB
SQLite startup concurrency repair
Scope and reproduced failure
The patched-source run was explicitly stopped05:55:08UTC after144passing and3failing logged cases out of351discovered cases. This is an interrupted failure, not a completed result. Portable raw hashes retain its command, traces and log even when later execution archives their paths.
Two unchanged client assertions receive SQLite error5/HTTP500: owned restored-job readback and language preference persistence. Read-only inspection of the isolated database reports journal_mode=delete, locking_mode=normal. Actual bootstrap opens the file during reconciliation before EF's normal database creation path can establish WAL. A deterministic regression invokes that bootstrap without starting a listener, worker or provider, holds a SELECT cursor on one connection and attempts the actual usage reservation on another. Before repair it reproduces the browser's SqliteDataRecord.Dispose → NextResult → AffectedCountModificationCommandBatch → AiUsageMeter.ReserveAsync failure. The separate startup assertion reports expectedwal, actualdelete.
The precise competing connection in the browser was not identified. The deterministic mechanism and unsafe journal mode are demonstrated; no claim is made that WAL eliminates all possible SQLite writer contention.
Bounded change and preservation
Startup executes PRAGMA journal_mode = WAL once before SQLite reconciliation. The existing provider branch excludes MariaDB/MySQL. No schema, stored field, tenant filter, Identity contract, quota rule, summary output, write payload or save semantics changes. There is no new retry, swallowed exception, relaxed timeout or disabled assertion. Existing VACUUM INTO backup already supports WAL; database guidance explains consistent snapshots.
The new ordinary backend cases verify fresh and populated startup, reopening persistent mode after a deliberately DELETE-mode database, unchanged owned/foreign rows and completed migration history; usage INSERT and Identity preference UPDATE while the SELECT cursor remains open; committed WAL contents in an independent integrity-checked backup that does not change after later source writes. Local file cleanup stays within the uniquely named disposable fixture directory.
Validation
| Run | Actual result | Qualification |
|---|---|---|
| Original focused RED,05:58:07–05:58:24UTC | 4PASS/2FAIL/0skipped | Startup mode and actual held-reader usage write fail; backup cases pass |
| Initial focused successor,05:58:44–05:58:53UTC | 5PASS/1FAIL/0skipped | Actual concurrent writes pass; populated-mode verification still used the external connection that set DELETE |
| Reopened-verification successor,05:59:34–05:59:41UTC | 6PASS/0FAIL/0skipped | Fixture closes the DELETE-setting connection before restart and reopens for the original expectedwal assertion; no production change or weaker expectation |
| Fresh full backend,05:59:54–06:00:10UTC | 1060PASS/0FAIL/0skipped | Current patched Release assemblies; plus3from1057:2startup/concurrency cases and1backup case |
| Ordinary affected browser vector,06:00:43–06:03:24UTC | 17PASS/0FAIL/0skipped/0flaky | Actual Audit, application forms and paginated Users cases; zero configured retries |
| Release build,06:03:48–06:03:50UTC | PASS/0warnings/0errors | API and backend test projects, locked existing restore, warnings treated as errors |
Portable repair evidence records the exact command/TRX/log paths and byte hashes for every backend attempt and the17-case native vector. Release build is recorded under .artifacts/phase7/current/backend-career/p702-release-20261021T060348Z/; its historical helper label does not make it Phase2 evidence. Complete351-case regression and the separate lanes remain required.
PRES-E02/E08/E09, S03/S04/S05, W01/W04 and the wider57-group matrix remain binding. This finite regression does not supply human/device acceptance or production restore, ingress/configuration/schema/rollback evidence. Production readiness stays NO-GO. No Phase8 or withheld P5-13 implementation is introduced.