fix(snapshot): reject dest journals; copy WAL-only families - #1019
Merged
ScriptedAlchemy merged 2 commits intoSep 7, 2026
Conversation
Unix replace now refuses a destination that still has WAL, SHM, or rollback-journal sidecars, so a leftover journal cannot replay into the new standalone backup. WAL families whose transient SHM is absent are copied as unlocked offline files and folded in staging, which keeps the source directory untouched. Copy-mode admission charges main+WAL only. Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
|
ScriptedAlchemy
marked this pull request as ready for review
September 7, 2026 13:55
…sor/snapshot-family-publish-fdd6
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
ScriptedAlchemy
merged commit Sep 7, 2026
047fec7
into
codex/tracedecay-total-redesign-plan-reopened
1 of 4 checks passed
ScriptedAlchemy
added a commit
that referenced
this pull request
Sep 7, 2026
Closes the #1019 replacement race (#1046). backup_live_sqlite_database no longer replaces an existing destination on any platform and never removes anything at the destination after publication. The whole destination family (main, -wal, -shm, -journal) is refused with AlreadyExists before the source is opened or staging is reserved, and publication is a kernel-atomic no-replace rename, so a main created concurrently keeps its own WAL/SHM and fails the attempt instead of being displaced. Both production callers already publish into a directory they exclusively created (LCM gc backup staging dir; the private snapshot scratch dir) and swap at a higher level, so the removed replacement path had no caller. Tests use before/after-publish seams to inject a real WAL-mode SQLite opener between the family check and the rename, and immediately after publication, proving neither the concurrent main nor a legitimate new family's sidecars are replaced or removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to merged #951. Codex review on that PR found three publication holes that #933's merge did not close.
renameof an existing destination now refuses a dest that still has-wal/-shm/-journalsidecars. A leftover journal stays bound to the old main and would be replayed against the new standalone backup.-shmis absent is treated as an unlocked offline family: main+WAL are copied into owned staging and folded there. Opening that source as a reader reconstructs SHM in the source directory.main + WALonly. SHM is never written by the online backup;copied_bytes()after Copy-mode is the published file size.Do not undraft or merge #707. This does not claim power-loss durability.
Motivation
#951 is merged and #933 is closed. The review findings are still real on the redesign branch:
SnapshotMode::Copyof WAL-without-SHM mutated the source (new-shm) after the byte-copy path was removed.main + WAL + SHMafter Copy-mode stopped copying SHM.Changes
crates/tracedecay-runtime-core/src/sqlite_read_snapshot.rscrates/tracedecay-runtime-core/src/sqlite_read_snapshot_backup_tests.rsAdmission is still a pre-flight upper bound (
main + WAL). It does not open the source forpage_count; a large repetitive WAL can still over-admit. Under-admitting frommainalone would be worse.Test plan
cargo test -p tracedecay-runtime-core --lib sqlite_read_snapshot::— 38 passedcargo clippy -p tracedecay-runtime-core --all-targets -- -D warningscargo test -p tracedecay-graph-db --features test-helpers --test durability_crash_contract— 7 passedChecklist
CHANGELOG.mdupdated (under[Unreleased]if no version bump).envfiles included