RDM/DVLS migration requests: locking, SQL and facade compatibility, legacy codecs

[Marc-André Moreau (mamoreau-devolutions)]

Implements the 36 fixes and improvements that Remote Desktop Manager and Devolutions Server asked for when moving to Ahtola v0.10.0. 32 are done; #13, #28, #32 and #34 are partial or handled differently (see below).

Locking and concurrency (#1–#6)

• Writer reservation (Vendor-qualify assemblies and remove YAML module support #1, fix: sign PowerShell modules with PSign cmdlets #6):
  • BEGIN IMMEDIATE, and a deferred transaction's first write, hold the cross-process write lock until the transaction ends.
  • The commit borrows the reservation; a failed commit hands it back.
  • Lock order: writer lock, then the in-process gate, then the cross-process mutex.
• Commits by another process: in WAL mode, these are detected by comparing a WAL content token (frame count, salts, change counter). The schema version alone missed commits made by native SQLite.
• Busy timeout (fix: use NuGet bot username for OIDC #3): now applies to waits on locks held by other processes. In rollback-journal mode, Ahtola releases SHARED while waiting for RESERVED, as SQLite does, which fixed a deadlock with native writers.
• Errors and retries (Fix CI warnings and reduce test duration #2, fix: restore PowerShell module artifact layout #4, fix: prevent unsigned release artifacts #5):
  • Lock errors surface as SqliteException with code 5 (SQLITE_BUSY).
  • A commit that failed on a busy lock can be retried.
  • A write on a connection with an open reader is no longer refused.

SQL compatibility (#7–#11, #17)

• PRAGMA auto_vacuum does nothing once tables exist.
• CURRENT_TIMESTAMP is accepted in upserts.
• CTE collation precedence matches SQLite.
• VACUUM INTO doesn't take the write lock.
• locking_mode=EXCLUSIVE takes its lock on the next statement.
• ALTER TABLE ADD COLUMN inserts the new column before the table constraints.

Files and journal modes (#12–#16, #18)

• A read-only open with -wal but no -shm falls back to foreign read-only mode.
• When the last connection closes, an empty -wal and the -shm are removed, as native SQLite does. A WAL that still holds frames, or one next to replica artifacts, is kept.
• An existing 0-byte file opens as a new database, unless a -wal or -journal exists next to it.
• busy_timeout, wal_autocheckpoint and journal_size_limit are honoured.
• WAL stays the default journal mode. A Journal Mode keyword creates a database in DELETE mode.

ADO.NET facade (#19–#27)

• GUIDs: BinaryGUID=False binds GUIDs as text; DbType.Guid with a string value is parsed.
• Type mapping: new Type Mapping=SystemDataSQLite option. The *ID column-name heuristic is now opt-in. GetValue returns non-GUID content in a guid column as stored.
• Connection strings: System.Data.SQLite keywords plus Ignore Unknown Keywords. Commands auto-enlist in the connection's transaction when Auto Enlist Transaction is set (off by default).
• Errors: a wrong key raises error 26 with SQLite's "file is encrypted or is not a database" text.
• Defaults: LocalProvider reports Managed when the keyword is absent. BLOB columns still report object by default (fix: treat omitted proto3 scalars in a logical-log range as zero #23), because DVLS stores text in BLOB columns.

Page codecs (#28–#31)

• Legacy codecs: Ahtola.Data.Sqlite.Codecs adds the System.Data.SQLite RC4 and wxSQLite3 AES-128 codecs, plus LegacyPageCodecs.Detect/DetectFile. Both are validated against files written by the native engines. SQLCipher v4 and ChaCha20 are not included: no native-written fixtures were available.
• Connection API: PageCodecCandidates and SelectedPageCodec. IPageCodec.MatchesHeader and PageCodecKeyMismatchException let a codec report a wrong key separately from a corrupt file.
• ChangePageCodec(IPageCodec?): re-encrypts the file in place under an exclusive lock.
• Docs: CodecId, threading and ownership.

Performance (#32, #33)

• Hot spots removed: the internally caught exceptions on the schema-ladder path (738 per run, down to 2) and slow schema-page rebuilding.
• Remaining gap: file-backed ladders still run at about 1.5–2× native. The remaining cost is spread across a checkpoint after each DDL commit, catalog copying and reparsing.
• Benchmarks: new RdmDvlsWorkloadBenchmarks compares Ahtola with Microsoft.Data.Sqlite + e_sqlite3. It covers the ladder, bulk insert, large text, LIKE scans and open, with each codec.
  • It flagged high allocation on bulk inserts of 20 KB text, which needs follow-up.

Packaging and docs (#34–#36)

• EF Core pins move to 10.0.12 / 9.0.20. The Microsoft.Data.Sqlite.Core dependency stays because EF Core's SQLite provider needs it.
• New docs/migrating-from-sqlite-providers.md. dotnet-packages.md, the README and the WAL interoperability contract are updated.

Also fixed

A second connection got "no such table" for a table another connection had just created. This bug predates this branch.

Tests

• New tests: RdmDvlsCompatibilityTests (42) and LegacyPageCodecTests (13, with fixtures from RDM).
• Updated tests: existing tests that expected the old behaviour (WAL left on disk after close, exception types, the GUID heuristic).
• Full suite (net10.0): 8,414 tests passed. It ran from a copy of the build output in a temp folder. The failures there were long paths that native SQLite can't open, plus tests that need the repo checkout. All of them pass when rerun from the repo, after the test updates above.
• Checks: validate-trim passes with 0 Ahtola warnings. validate-project-closure and the package-closure script tests (16/16) pass.
• Formatting: the changed files add no new format-check violations. Violations that predate this branch remain.

🤖 Generated with Claude Code