What's this about?
Tailscale had been suffering intermittent database corruption in its control plane — the service that coordinates customers' private networks. Each incident meant taking a shard offline to repair or restore, which knocked out the control plane for every customer on it. They eventually traced the cause all the way down into SQLite itself: a data race in the write-ahead log reset path that had been present for sixteen years. They funded an open-source SQLite debugging tool to isolate it, and bought a SQLite support contract.
What exactly is a "WAL reset"?
SQLite's write-ahead log (WAL) is a scratch file where new changes are written first, so readers can keep reading the main database file undisturbed. Periodically SQLite folds those changes into the main file and resets the log back to empty. The bug lives in that reset moment: under precise, rare timing, two things touch the log at once and the database ends up inconsistent. Think of a restaurant order pad that gets torn off and started fresh at exactly the instant a new order is being written — one ticket ends up half on each pad.
What's the community saying?
- Corporate funding of open source, done well. The most-appreciated detail was that Tailscale paid for the development of a very specific new debugging tool (a SQLite VFS shim) and took out a support contract, rather than just filing a bug report.
- "It is unlikely to occur in common use" undersells it. Several commenters pushed back on that framing: a large customer *did* hit it, so anyone with a similar single-writer setup should update immediately rather than assume they're safe.
- Fault-injection testing is the real lesson. An experienced commenter described writing block-device fault-injection layers that immediately uncovered flaws in a database project that described itself as well-tested — the argument being that this class of bug is findable, but only with adversarial tooling.
- The single point of failure. Attention landed on the operational design: losing one shard's control plane during recovery meant total outage for those tenants, which people found more alarming than the SQLite bug itself.
- The emotional beat. A widely-liked comment simply quoted Tailscale's line about finally being confident they'd found and understood the bug, calling that feeling the thing engineers chase.