fix(ticket-017): close SQLite handles before cleanup and redact failures

[tom-sapletta-com]

SQLite recovery failures could remove the staging directory while its database connections were still open and include private exception text in the recovery receipt. Close both connections before staging cleanup and return a generic failure finding while preserving the original and quarantine.

This completes the two source changes preserved from ticket-015 after PR14 merged. Regression coverage injects failed imports and failed destination opens, checks handle lifetime during cleanup, and rejects private exception text.

Validation: 245 product tests pass; 9 optional integration tests skipped. The mandatory real X11 fixture closes one of four windows sharing one process and preserves the other three. Managed governance passes at the current target base. Native OneDev verification and independent exact-head Validator approval are required before merge.

Ticket: ticket-017. Scope: src/uncrash/recovery.py and tests/test_diagnostics.py.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 5fccfbff585845049034f9254d0ee87e468023db.

Ticket: ticket-017
Correlation ID: local-semcod-uncrash-pr-16-ticket-017
Model: openai/cursor-auto
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Visible changes close SQLite salvage connections in a finally block before staging cleanup and replace exception-interpolated diagnosticFinding with a generic message, reducing private-detail leakage. Required protected checks all PASS (governance / remote lifecycle, governance / enforce, onedev/local-verify). Ticket/docs claim AC-02 still pending, which is stale relative to the structured check assessment and is not a code defect. | Chunk 2 adds regression coverage for salvage_agent_session_db failure paths: injected import and destination-open failures, connection closed before TemporaryDirectory cleanup, FAILED receipt with failed integrity, original/quarantine byte preservation, and no leftover staging dirs. Required protected checks all PASS (governance / remote lifecycle, governance / enforce, onedev/local-verify). Visible test logic is consistent with the stated recovery cleanup and privacy goals.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: b28b6ebc1c92209301966e81fb25a857e1b326f9...5fccfbff585845049034f9254d0ee87e468023db
Change digest: f70927368a4544f34f4dac1198583c69fee2e8d4892d231ce469db5ce66a571c
Score: 60/100 (M), estimated 57 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":194,"base_sha":"b28b6ebc1c92209301966e81fb25a857e1b326f9","binary_files":0,"categories":{"code":1,"configuration":1,"docs":2,"tests":1},"change_digest":"f70927368a4544f34f4dac1198583c69fee2e8d4892d231ce469db5ce66a571c","comparison":"b28b6ebc1c92209301966e81fb25a857e1b326f9...5fccfbff585845049034f9254d0ee87e468023db","deletions":30,"file_count":5,"files":["project/TICKETS.md","project/ticket-017/README.md","project/ticket-017/intent.json","src/uncrash/recovery.py","tests/test_diagnostics.py"],"head_sha":"5fccfbff585845049034f9254d0ee87e468023db","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":4,"delivery":4,"scope":2,"uncertainty":3,"validation":2},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":57,"within_budget":false},"impact":{"components":["project","src/uncrash","tests"],"files":["project/TICKETS.md","project/ticket-017/README.md","project/ticket-017/intent.json","src/uncrash/recovery.py","tests/test_diagnostics.py"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":60,"split":{"parts":[{"estimated_minutes":16,"name":"Implement project","scope":["project"]},{"estimated_minutes":16,"name":"Implement src/uncrash","scope":["src/uncrash"]},{"estimated_minutes":16,"name":"Implement tests","scope":["tests"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-017"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-017: fix(ticket-017): close SQLite handles before cleanup and redact failures</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 97,53 79,85 54,78 31,53" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 57m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-017-4979
TICKET ticket-017
HEAD_SHA 5fccfbff585845049034f9254d0ee87e468023db
CORRELATION_ID local-semcod-uncrash-pr-16-ticket-017
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance / remote lifecycle=PASS","governance / enforce=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["governance / enforce","governance / remote lifecycle","onedev/local-verify"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/uncrash","pull_request":16,"head_sha":"5fccfbff585845049034f9254d0ee87e468023db","base_sha":"b28b6ebc1c92209301966e81fb25a857e1b326f9","diff_sha256":"50b26397d1583c03e81cb82a2212fe0d98c3fb1bcf3f6ccc74d99060c9e9cdc1"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["project/TICKETS.md","project/ticket-017/README.md","project/ticket-017/intent.json","src/uncrash/recovery.py","tests/test_diagnostics.py"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"b28b6ebc1c92209301966e81fb25a857e1b326f9","head_sha":"5fccfbff585845049034f9254d0ee87e468023db","change_digest":"f70927368a4544f34f4dac1198583c69fee2e8d4892d231ce469db5ce66a571c","score":60,"complexity":"M","estimated_minutes":57,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"