Log SQLite recovery approval codes

Print the final incident token and document the quarantine-only recovery path.

Author: dannyvfilms

README.md

@@ -619,17 +619,14 @@ this prevents Docker restart policies from repeating the same failure.
 
 The report identifies the incident with a fingerprint and issues a separate
 one-time **incident token**. The startup log prints the exact value to set, and
-the report repeats it under `actions`. Copy that token; the fingerprint is an
-identifier, not an approval. There are three choices:
+the report repeats it under `actions`. Copy the approval code from the startup
+log, or use the matching `incident_token`/`actions` entry in the protected
+report; the fingerprint is an identifier, not an approval. There are two
+choices:
 
 1. **Restore or repair:** stop Floppy, back up the database with its `-wal` and
    `-shm` files, then restore a known-good copy or repair the named rows.
-2. **Accept:** set `FLOPPY_SQLITE_CONFLICT_ACTION=accept:<incident-token>` and
-   recreate the container. Floppy starts without changing the conflicting rows.
-   Accept gets you back online on your current schema. It is not an upgrade
-   path: Django re-checks every foreign key while it applies a migration, so a
-   pending migration keeps failing until you repair or quarantine the rows.
-3. **Quarantine:** set
+2. **Quarantine:** set
    `FLOPPY_SQLITE_CONFLICT_ACTION=quarantine:<incident-token>` and recreate the
    container. Floppy first writes and verifies a full backup under
    `sqlite-recovery/`, then removes the orphaned child rows and verifies all

src/config/sqlite_recovery_policy.py

@@ -538,6 +538,18 @@ def _annotate_blocked_report(
     return plan
 
 
+def _log_blocked_recovery_options(report: dict, plan: dict) -> None:
+    """Print the current repair approval code for a final blocked incident."""
+    token = report.get("incident_token")
+    if not plan.get("can_repair") or not isinstance(token, str) or not token:
+        return
+    _log(f"[entrypoint] SQLite recovery approval code: {token}")
+    _log(
+        "[entrypoint] To approve relationship repair, set "
+        f"{_ACTION_ENV}=quarantine:{token} and restart Floppy.",
+    )
+
+
 def check_database_for_startup(db_path: str) -> None:
     """Repair safe relationship damage or block before migrations."""
     emit = _status_emitter(db_path)
@@ -568,6 +580,7 @@ def check_database_for_startup(db_path: str) -> None:
         and plan.get("can_repair")
         and int(plan.get("safe_relationships", 0)) > 0
     ):
+        _log_blocked_recovery_options(report, plan)
         raise SystemExit(1)
 
     emit("running", "repair")
@@ -615,9 +628,10 @@ def check_database_for_startup(db_path: str) -> None:
     refreshed = _scan_and_publish_block(db_path, emit)
     if refreshed is None:
         return
-    _annotate_blocked_report(
+    refreshed_plan = _annotate_blocked_report(
         db_path,
         refreshed,
         prior_safe_repair=safe_summary,
     )
+    _log_blocked_recovery_options(refreshed, refreshed_plan)
     raise SystemExit(1)

src/config/tests/test_sqlite_data_preserving_recovery.py

@@ -1,3 +1,4 @@
+import io
 import json
 import os
 import sqlite3
@@ -95,7 +96,7 @@ def test_mixed_music_damage_preserves_tracking_until_explicit_repair(self):
                     },
                 ),
                 self.assertRaises(SystemExit) as blocked,
-                mock.patch("sys.stderr"),
+                mock.patch("sys.stderr", new_callable=io.StringIO) as stderr,
             ):
                 check_database_for_startup(db_path)
 
@@ -123,6 +124,18 @@ def test_mixed_music_damage_preserves_tracking_until_explicit_repair(self):
             conn.close()
 
             report = self._read_report(db_path)
+            token = report["incident_token"]
+            log_output = stderr.getvalue()
+            self.assertIn(f"SQLite recovery approval code: {token}", log_output)
+            self.assertIn(
+                f"FLOPPY_SQLITE_CONFLICT_ACTION=quarantine:{token}",
+                log_output,
+            )
+            self.assertEqual(
+                log_output.count("FLOPPY_SQLITE_CONFLICT_ACTION=quarantine:"),
+                1,
+            )
+            self.assertNotIn("FLOPPY_SQLITE_CONFLICT_ACTION=accept:", log_output)
             self.assertEqual(report["status"], "blocked")
             self.assertNotIn("accept", report["actions"])
             self.assertIn("quarantine", report["actions"])