fix(state): avoid WAL unlink race during state.db repair

[JoaoMarcos44]

Summary

• Restores the pre-repair journal mode through the exclusive repair connection.
• Prevents a second connection from recreating state.db-wal after the old WAL was unlinked.

Root cause
Journal-mode restoration opened a new connection after the exclusive repair guard had released the live database. In WAL mode, a writer could retain the unlinked WAL inode while that second connection created a fresh state.db-wal path.

Bottleneck scan
The focused repair path remains serialized by _exclusive_repair_db_guard. No additional correctness bottleneck was found in hermes_state.py or the regression test; unrelated checkpoint/VACUUM paths were not changed.

Tests

• scripts/run_tests.sh tests/state/test_state_db_wal_unlink_race.py -q
• 1 passed, 0 failed

Limitations

• Focused regression covers connection reuse; no live multi-process corruption reproduction was available.

Closes #101064

[Enough1122]

AI code review — automated review for reference; please use your judgment.

PR #101085 — fix(state): avoid WAL unlink race during state.db repair + truncated Telegram preview fix (#98552)

• Title describes the WAL branch; diff also bundles the Telegram stream fix under the same commit (branch name fix/98552-...). Both slices are independently correct — see also standalone fix(state): refuse SessionDB open and writes on a deleted WAL generation #101081 for the WAL-generation guard.
• WAL repair slice (hermes_state.py:57-119, tests/state/test_state_db_wal_unlink_race.py:499-510): _restore_journal_mode_after_repair(db_path, before_mode, *, conn=None) now optionally reuses an already-open exclusive repair connection (owned_conn flag). repair_state_db_schema captures before_mode = _probe_journal_mode_for_repair and _repair_state_db_schema_locked passes it down; after a successful scratch-copy repair _restore_journal_mode_after_repair(..., conn=live_guard) re-applies WAL/DELETE inside the same live_guard that still holds the DB lock. Prevents the window where a second connection creates a fresh state.db-wal after the old one was unlinked while the guard had released. New test test_wal_restoration_reuses_exclusive_repair_connection asserts _connect_repair_durable is never called.
• Stream slice (plugins/platforms/telegram/adapter.py:131-155,174-191, gateway/stream_consumer.py:10-45,43-45, tests/gateway/test_truncated_preview_ack.py:195-475): Telegram's saturated progressive edits (≥4096 UTF-16) are clipped to one message instead of split (avoiding fix(telegram): Infinite streamed message duplication loop during 4096-char overflow #48648 duplication loop). Previously the clipped edit returned bare SendResult(success=True) so GatewayStreamConsumer advanced _last_sent_text to the requested text, not the shorter prefix Telegram stored — every "already seen" derivation (_visible_prefix, _continuation_text, turn-final payload reconciliation) then described text no API call carried, causing delivered_final_matches to falsely report delivery and suppressing the gateway's corrective send (frozen clipped preview, Telegram streaming finalize fails — message truncated well under 4096 chars, content_delivered=True false positive #98552). Adapter now returns SendResult(raw_response={"stream_preview_truncated": True, "delivered_prefix": truncated}) on all three paths (saturation dedup, clipped send, truncated overflow). Consumer adds _delivered_text_for(result, sent_text) and advances self._last_sent_text from result.raw_response["delivered_prefix"] when present. Tests pin both layers and the end-to-end ClippingAdapter scenario (clipped preview + failed final edit → must not claim final delivery).

Non-blocking:

• _restore_journal_mode_after_repair is still best-effort (WARNING on failure, never raises) — repair success is not retroactively failed by journal-mode re-apply.
• delivered_prefix == "" is treated as absent so under-cap edits keep bare-success contract (no false positives).

Verdict: LGTM. Two leakage fixes in one PR: exclusive-connection WAL restore closes the post-repair split-brain, and delivered-prefix tracking closes the clipped-preview silent-loss.

[kshitijk4poor]

Salvaged via #101736 (merged; the WAL commit cherry-picked with authorship preserved). The bundled Telegram preview commit was dropped — #98552 was already closed via #100533. Confirmed not redundant: main still reopened state.db after the guard released. Your unit test could only run on non-WAL-reset SQLite builds (never on macOS 3.46), so I added an end-to-end test through repair_state_db_schema that traces every connection against the guard's enter/exit and fails on main's shape on every platform. Thanks @JoaoMarcos44. Closing in favour of the salvage PR.