Freegle / Iznik / 22728

72%

push

circleci

fix(spatial): rebuild() must drop the orphaned -wal/-shm before reopen

server.rebuild() renamed only the freshly built .db over the old file, leaving
the previous index's -wal/-shm on disk. On reopen SQLite replayed that stale
WAL onto the new .db and corrupted it — every subsequent delta upsert/delete
then failed with "database disk image is malformed". Observed in production:
the messages index was corrupt from 2026-06-16 and an admin rebuild could not
recover it (the rebuild itself re-orphaned the WAL), and the nightly
rebuildAll would have re-corrupted every dataset the same way.

Remove the old .db-wal/.db-shm (and the temp .building sidecars) after the
rename and before OpenIndex. The freshly built .db is already complete
(Checkpoint flushed its WAL), and the old live index keeps serving reads via
its already-open fds until swapIndex, so this is safe before the swap.

Regression test reproduces the orphaned-WAL scenario via server.rebuild().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013w6Mt4Cx6Wg8WsHBCMJeVb

11048 of 14682 branches covered (75.25%)

Branch coverage included in aggregate %.

120460 of 171626 relevant lines covered (70.19%)

35.86 hits per line