fix(repair): run SQLite integrity preflight before chromadb open (follow-up to #1364)

[igorls]

Follow-up to #1364 found via manual smoke test of v3.3.5 develop tip.

What does this PR do?

#1364 added the SQLite `PRAGMA quick_check` preflight to `rebuild_index`, but placed it AFTER `backend.get_collection(...)`. ChromaDB's rust binding raises `pyo3_runtime.PanicException` on a malformed page — and PanicException is not a regular `Exception` subclass, so it propagates past the existing `except Exception` handlers. The user gets a 30-line stack trace instead of the friendly abort message #1364 was designed to deliver.

Repro

PALACE=/tmp/palace
# build a healthy palace
mempalace --palace $PALACE init --yes some-project
mempalace --palace $PALACE mine some-project

# mangle 4 pages in the middle of chroma.sqlite3
python3 -c "
import os
p = '$PALACE/chroma.sqlite3'
with open(p, 'r+b') as f:
    f.seek(40960)
    f.write(b'\xDE\xAD\xBE\xEF' * 4096)
"

mempalace --palace $PALACE repair --yes

Pre-fix: `pyo3_runtime.PanicException: Expect it to be fetched: Database(SqliteError { code: 11, message: "database disk image is malformed" })` and a long Python traceback.

Post-fix: the `ABORT: SQLite-layer corruption detected before repair rebuild` message with the documented recovery steps, and exit code 1.

What changed

• `mempalace/cli.py` `cmd_repair`: run `sqlite_integrity_errors()` right after the basic palace-existence check, BEFORE `maybe_repair_poisoned_max_seq_id_before_rebuild` (which opens sqlite3) and BEFORE `backend = ChromaBackend()`. Exit non-zero so unattended scripts and CI gates see the failure.
• `mempalace/repair.py` `rebuild_index`: same move at the function level for direct callers (tests, MCP) that bypass `cmd_repair`.

Why the bug shipped CI-green

The previously-shipping abort-path test (`test_rebuild_index_aborts_on_sqlite_integrity_errors_before_delete_collection`) mocks both `ChromaBackend` and `sqlite_integrity_errors`. With both mocked, the ordering of the preflight relative to the real chromadb open never gets exercised — the test passes regardless of whether the preflight runs before or after the (mocked, never-crashing) `get_collection` call.

New test

`test_rebuild_index_runs_sqlite_preflight_before_chromadb_open` uses:

• A real chromadb-built palace (no `ChromaBackend` mock), so `get_collection` actually opens the rust binding
• A real corrupt SQLite (16 KB of mangled pages mid-file), so quick_check actually fails
• No mock of `sqlite_integrity_errors`, so the real preflight runs

I verified the test fails on the pre-fix code (panic) and passes on the fixed code (clean abort).

Test fixture cleanup

Six existing `test_cli.py` `cmd_repair` tests used `(palace_dir / "chroma.sqlite3").write_text("db")` to stub the SQLite file. The new preflight correctly fails quick_check on those 2-byte stubs, so the tests now create empty real SQLite DBs the same way the `test_repair.py` fixtures already do.

Local verification

```
1624 passed, 1 skipped (was 1623 before this PR's new test)
ruff lint + format clean against the 0.4.x CI pin
```

Closes nothing on its own — fixes a regression in already-merged #1364. Fits naturally in v3.3.5.

[Copilot]

Pull request overview

This PR fixes a regression in the repair flow where the SQLite integrity preflight (PRAGMA quick_check) ran after opening ChromaDB, allowing Chroma’s Rust binding to panic on corrupted SQLite pages before MemPalace could print the intended friendly abort message.

Changes:

• Move SQLite quick_check preflight earlier in repair.rebuild_index() (before any ChromaDB open).
• Add the same earlier preflight to cli.cmd_repair, exiting with code 1 on corruption so scripts/CI can detect failure.
• Add a regression test that uses a real ChromaDB palace + deliberately corrupted SQLite DB; update CLI tests to create real empty SQLite files instead of 2-byte stubs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
mempalace/repair.py	Runs SQLite integrity preflight before any ChromaDB client open in rebuild_index().
mempalace/cli.py	Adds early SQLite integrity preflight to cmd_repair() and exits non-zero on corruption.
tests/test_repair.py	Adds regression test ensuring preflight runs before ChromaDB open using real corruption.
tests/test_cli.py	Updates repair CLI tests to create valid SQLite DB files so the new preflight doesn’t fail on stubs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[igorls]

Good catch — fixed in 7b15103.

Replaced the unconditional f.seek(40960) with a page-aligned offset computed from pre_size. Now there are explicit asserts that the file holds at least HEADER_GUARD + CORRUPT_BYTES (12 KB), the offset is rounded down to a 4 KB page boundary, and it never lands within the first two pages so the file still opens. If a future SQLite/chromadb version returns a smaller initial DB the test fails with a clear assertion instead of silently extending the file.