| 2118 | } store_recovery_status_t; |
| 2119 | |
| 2120 | static cbm_store_t *resolve_store_internal(cbm_mcp_server_t *srv, const char *project, |
| 2121 | bool mutation_already_held, bool nonblocking_recovery, |
| 2122 | store_recovery_status_t *recovery_status) { |
| 2123 | if (recovery_status) { |
| 2124 | *recovery_status = STORE_RECOVERY_NONE; |
| 2125 | } |
| 2126 | if (!project) { |
| 2127 | return NULL; /* project is required — no implicit fallback */ |
| 2128 | } |
| 2129 | |
| 2130 | srv->store_last_used = time(NULL); |
| 2131 | |
| 2132 | /* Already open for this project? */ |
| 2133 | if (srv->current_project && strcmp(srv->current_project, project) == 0 && srv->store) { |
| 2134 | return srv->store; |
| 2135 | } |
| 2136 | |
| 2137 | /* Close old store */ |
| 2138 | if (srv->owns_store && srv->store) { |
| 2139 | cbm_store_close(srv->store); |
| 2140 | srv->store = NULL; |
| 2141 | } |
| 2142 | |
| 2143 | /* Open project's .db file — query-only open (no SQLITE_OPEN_CREATE) to |
| 2144 | * prevent ghost .db file creation for unknown/unindexed projects. |
| 2145 | * #1425: an invalid project name yields an empty path. SQLite opens "" |
| 2146 | * as an anonymous temp db, which then fails the integrity check and |
| 2147 | * quarantines a db that never existed — as a RELATIVE .corrupt.<hex> |
| 2148 | * file in the daemon's cwd. Skip the direct open entirely; the fallback |
| 2149 | * scan below still resolves legacy dbs whose internal name predates |
| 2150 | * validation. */ |
| 2151 | char path[CBM_SZ_1K]; |
| 2152 | project_db_path(project, path, sizeof(path)); |
| 2153 | srv->store = path[0] ? cbm_store_open_path_query(path) : NULL; |
| 2154 | if (srv->store) { |
| 2155 | /* Check DB integrity — back up (never silently delete) a corrupt DB */ |
| 2156 | if (!cbm_store_check_integrity(srv->store)) { |
| 2157 | cbm_store_close(srv->store); |
| 2158 | srv->store = NULL; |
| 2159 | bool mutation_acquired = mutation_already_held; |
| 2160 | if (!mutation_acquired) { |
| 2161 | mutation_acquired = nonblocking_recovery |
| 2162 | ? mcp_project_mutation_try_begin(srv, project) |
| 2163 | : mcp_project_mutation_begin(srv, project); |
| 2164 | } |
| 2165 | if (!mutation_acquired) { |
| 2166 | if (nonblocking_recovery && recovery_status) { |
| 2167 | *recovery_status = srv->mutation_try_begin |
| 2168 | ? STORE_RECOVERY_BUSY |
| 2169 | : STORE_RECOVERY_TRY_GUARD_UNAVAILABLE; |
| 2170 | } |
| 2171 | return NULL; |
| 2172 | } |
| 2173 | |
| 2174 | /* The lease may have waited behind a publisher. Re-open and trust |
| 2175 | * only the current generation, never the stale pre-wait verdict. |
| 2176 | * Use the verdict API here — this is the point that decides whether |
| 2177 | * a healthy DB gets quarantined. The plain bool check cannot tell |
no test coverage detected