fix(server): snapshot service-update databases with VACUUM INTO

[Adolanium]

What Changed

Service-update database backup now uses VACUUM INTO instead of copying state.sqlite plus WAL plus shm.

That writes one consistent file. Restore still copies that file and drops leftover WAL and shm sidecars. A completed backup is still never overwritten.

Why

A live-style copy of sqlite plus WAL plus shm can be a torn snapshot. Agents.md already says VACUUM INTO is the safe way. The launcher comment said the previous child is dead, so a quiet copy can work. Residual risk remains on Windows mapped shm and sequential copies.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (N/A)
• I included a video for animation/interaction changes (N/A)

---

Note

Medium Risk
Changes pre-update backup semantics for user SQLite state during service updates; incorrect snapshots or restore could lose data, though VACUUM INTO is intended to reduce torn-backup risk versus multi-file copy.

Overview
Service-update database backups no longer copy the live state.sqlite file plus -wal/-shm sidecars. backupDatabaseOnce now writes a single consistent snapshot via a new vacuumDatabaseInto helper that opens the source read-only and runs VACUUM INTO, with Windows path normalization and quoted destination paths.

Staging still uses a temp dir, chmod 0o600, fsync, and atomic rename; restore behavior is unchanged in shape—it still copies the backed-up main file and strips leftover sidecars when rollback runs.

Tests seed real SQLite databases instead of plain text, add direct coverage for vacuumDatabaseInto (data integrity, no WAL/SHM on the snapshot, POSIX literal backslash in destinations), and assert rollback restores pre-migration row data and clears trial WAL/SHM files.

^{Reviewed by Cursor Bugbot for commit 37b50d2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Snapshot service-update databases with VACUUM INTO in backupDatabaseOnce

• Replaces file-copy backup with vacuumDatabaseInto, which opens the source DB read-only and runs VACUUM INTO to produce a single consistent snapshot file
• Adds quoteSqliteLiteral to safely embed the destination path in the SQL statement; on Windows, backslashes are converted to forward slashes before quoting
• Backup directory now contains a single vacuumed DB file (mode 0600) instead of separate copies of the main DB and any -wal/-shm sidecars
• Tests in serviceLauncher.test.ts now use real SQLite databases via a seedSqlite helper, including new tests for VACUUM INTO snapshotting and POSIX backslash handling
• Risk: backupDatabaseOnce no longer copies -wal/-shm files; any code expecting sidecar files in the backup directory will break

^{Macroscope summarized 37b50d2.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7d3047eb-90f7-403b-869d-b1f0d5c58321

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f021eae. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved at 37b50d2

Macroscope's review found this PR approvable — This is a contained service-update reliability fix that replaces potentially torn SQLite file copies with a consistent single-file snapshot while retaining the existing staging, durability, and restore flow. Production logic is limited to the rollback backup path, and the updated tests exercise snapshot integrity and launcher rollback behavior.

^{You can add or adjust custom eligibility rules. Learn more.}