Index: VERSION
==================================================================
--- VERSION
+++ VERSION
@@ -1,1 +1,1 @@
-3.50.0
+3.50.2

Index: autoconf/Makefile.in
==================================================================
--- autoconf/Makefile.in
+++ autoconf/Makefile.in
@@ -222,11 +222,11 @@
 # Flags to link the shell app either directly against sqlite3.c
 # (ENABLE_STATIC_SHELL==1) or libsqlite3.so (ENABLE_STATIC_SHELL==0).
 #
 ENABLE_STATIC_SHELL = @ENABLE_STATIC_SHELL@
 sqlite3-shell-link-flags.1 = $(TOP)/sqlite3.c $(LDFLAGS.libsqlite3)
-sqlite3-shell-link-flags.0 = -L. -lsqlite3 $(LDFLAGS.zlib)
+sqlite3-shell-link-flags.0 = -L. -lsqlite3 $(LDFLAGS.zlib) $(LDFLAGS.math)
 sqlite3-shell-deps.1 = $(TOP)/sqlite3.c
 sqlite3-shell-deps.0 = $(libsqlite3.DLL)
 #
 # STATIC_CLI_SHELL = 1 to statically link sqlite3$(T.exe), else
 # 0. Requires static versions of all requisite libraries. Primarily

Index: autoconf/tea/README.txt
==================================================================
--- autoconf/tea/README.txt
+++ autoconf/tea/README.txt
@@ -38,29 +38,37 @@
 of the tclsh that you want the SQLite extension to work with.  See
 step-by-step instructions at the links below for more information:
 
     https://sqlite.org/src/doc/trunk/doc/compile-for-unix.md
     https://sqlite.org/src/doc/trunk/doc/compile-for-windows.md
+
+And info about the extension's Tcl interface can be found at:
+
+    https://sqlite.org/tclsqlite.html
 
 The whole point of the amalgamation-autoconf tarball (in which this
-README.txt file is embedded) is to provide a means of compiling
-SQLite that does not require first installing TCL and/or "tclsh".
-The canonical Makefile in the SQLite source tree provides more
-capabilities (such as the the ability to run test cases to ensure
-that the build worked) and is better maintained.  The only
-downside of the canonical Makefile is that it requires a TCL
-installation.  But if you are wanting to build the TCL extension for
-SQLite, then presumably you already have a TCL installation.  So why
-not just use the more-capable and better-maintained canoncal Makefile?
-
-This TEA builder is derived from code found at
+README.txt file is embedded) is to provide a means of compiling SQLite
+that does not require first installing TCL and/or "tclsh".  The
+canonical Makefile in the SQLite source tree provides more
+capabilities (such as the the ability to run test cases to ensure that
+the build worked) and is better maintained.  The only downside of the
+canonical Makefile is that it requires a TCL installation.  But if you
+are wanting to build the TCL extension for SQLite, then presumably you
+already have a TCL installation.  So why not just use the more-capable
+and better-maintained canoncal Makefile?
+
+As of version 3.50.0, this build process uses "teaish":
+
+    https://fossil.wanderinghorse.net/r/teaish
+
+which is conceptually derived from the pre-3.50 toolchain, TEA:
 
     http://core.tcl-lang.org/tclconfig
     http://core.tcl-lang.org/sampleextension
 
-The SQLite developers do not understand how it works.  It seems to
-work for us.  It might also work for you.  But we cannot promise that.
+It to works for us.  It might also work for you.  But we cannot
+promise that.
 
 If you want to use this TEA builder and it works for you, that's fine.
 But if you have trouble, the first thing you should do is go back
 to using the canonical Makefile in the SQLite source tree.
 
@@ -68,17 +76,15 @@
 
 
 UNIX BUILD
 ==========
 
-Building under most UNIX systems is easy, just run the configure script
-and then run make. For more information about the build process, see
-the tcl/unix/README file in the Tcl src dist. The following minimal
-example will install the extension in the /opt/tcl directory.
+Building under most UNIX systems is easy, just run the configure
+script and then run make. For example:
 
 	$ cd sqlite-*-tea
-	$ ./configure --prefix=/opt/tcl
+	$ ./configure --with-tcl=/path/to/tcl/install/root
 	$ make
 	$ make install
 
 WINDOWS BUILD
 =============
@@ -87,13 +93,12 @@
 Msys + Mingw build process. This provides a Unix-style build while
 generating native Windows binaries. Using the Msys + Mingw build tools
 means that you can use the same configure script as per the Unix build
 to create a Makefile. See the tcl/win/README file for the URL of
 the Msys + Mingw download.
-
 If you have VC++ then you may wish to use the files in the win
 subdirectory and build the extension using just VC++. These files have
 been designed to be as generic as possible but will require some
 additional maintenance by the project developer to synchronise with
 the TEA configure.in and Makefile.in files. Instructions for using the
 VC++ makefile are written in the first part of the Makefile.vc
 file.

Index: autosetup/teaish/core.tcl
==================================================================
--- autosetup/teaish/core.tcl
+++ autosetup/teaish/core.tcl
@@ -520,11 +520,11 @@
         set tclsh [get-define TCLSH_CMD]
         set vsat "package vsatisfies \[ package provide $pkg \] $vcheck"
         set vputs "puts \[ $vsat \]"
         #puts "*** vputs = $vputs"
         scan [exec echo $vputs | $tclsh] %d vvcheck
-        if {0 == $vvcheck} {
+        if {![info exists vvcheck] || 0 == $vvcheck} {
           proj-fatal -up $tclsh "check failed:" $vsat
         }
       }
       if {$::teaish__Config(vsatisfies-error)} {
         set vunsat \

Index: ext/fts5/fts5Int.h
==================================================================
--- ext/fts5/fts5Int.h
+++ ext/fts5/fts5Int.h
@@ -18,10 +18,11 @@
 #include "sqlite3ext.h"
 SQLITE_EXTENSION_INIT1
 
 #include <string.h>
 #include <assert.h>
+#include <stddef.h>
 
 #ifndef SQLITE_AMALGAMATION
 
 typedef unsigned char  u8;
 typedef unsigned int   u32;

Index: ext/fts5/fts5_storage.c
==================================================================
--- ext/fts5/fts5_storage.c
+++ ext/fts5/fts5_storage.c
@@ -537,10 +537,11 @@
   ctx.pStorage = p;
   ctx.iCol = -1;
   for(iCol=1; rc==SQLITE_OK && iCol<=pConfig->nCol; iCol++){
     if( pConfig->abUnindexed[iCol-1]==0 ){
       sqlite3_value *pVal = 0;
+      sqlite3_value *pFree = 0;
       const char *pText = 0;
       int nText = 0;
       const char *pLoc = 0;
       int nLoc = 0;
 
@@ -553,15 +554,26 @@
       }
 
       if( pConfig->bLocale && sqlite3Fts5IsLocaleValue(pConfig, pVal) ){
         rc = sqlite3Fts5DecodeLocaleValue(pVal, &pText, &nText, &pLoc, &nLoc);
       }else{
-        pText = (const char*)sqlite3_value_text(pVal);
-        nText = sqlite3_value_bytes(pVal);
-        if( pConfig->bLocale && pSeek ){
-          pLoc = (const char*)sqlite3_column_text(pSeek, iCol + pConfig->nCol);
-          nLoc = sqlite3_column_bytes(pSeek, iCol + pConfig->nCol);
+        if( sqlite3_value_type(pVal)!=SQLITE_TEXT ){
+          /* Make a copy of the value to work with. This is because the call
+          ** to sqlite3_value_text() below forces the type of the value to
+          ** SQLITE_TEXT, and we may need to use it again later. */
+          pFree = pVal = sqlite3_value_dup(pVal);
+          if( pVal==0 ){
+            rc = SQLITE_NOMEM;
+          }
+        }
+        if( rc==SQLITE_OK ){
+          pText = (const char*)sqlite3_value_text(pVal);
+          nText = sqlite3_value_bytes(pVal);
+          if( pConfig->bLocale && pSeek ){
+            pLoc = (const char*)sqlite3_column_text(pSeek, iCol+pConfig->nCol);
+            nLoc = sqlite3_column_bytes(pSeek, iCol + pConfig->nCol);
+          }
         }
       }
 
       if( rc==SQLITE_OK ){
         sqlite3Fts5SetLocale(pConfig, pLoc, nLoc);
@@ -573,10 +585,11 @@
         if( rc==SQLITE_OK && p->aTotalSize[iCol-1]<0 ){
           rc = FTS5_CORRUPT;
         }
         sqlite3Fts5ClearLocale(pConfig);
       }
+      sqlite3_value_free(pFree);
     }
   }
   if( rc==SQLITE_OK && p->nTotalRow<1 ){
     rc = FTS5_CORRUPT;
   }else{

Index: ext/fts5/test/fts5faultI.test
==================================================================
--- ext/fts5/test/fts5faultI.test
+++ ext/fts5/test/fts5faultI.test
@@ -322,8 +322,28 @@
       {1 {FOREIGN KEY constraint failed}} \
       {1 {out of memory}} \
       {1 {constraint failed}}
   }
 }
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 13.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a, b);
+  INSERT INTO t1 VALUES('abc def', X'123456');
+}
+faultsim_save_and_close
+
+
+do_faultsim_test 13 -faults oom* -prep {
+  faultsim_restore_and_reopen
+} -body {
+  execsql {
+    UPDATE t1 SET a='def abc'
+  }
+} -test {
+  faultsim_test_result {0 {}}
+}
 
 finish_test
 

Index: ext/fts5/test/fts5unicode4.test
==================================================================
--- ext/fts5/test/fts5unicode4.test
+++ ext/fts5/test/fts5unicode4.test
@@ -25,7 +25,37 @@
 }
 
 do_execsql_test 1.1 {
   INSERT INTO sss VALUES('まりや');
 }
+
+foreach {tn enc tok} {
+  1   utf-8    ascii
+  2   utf-16   ascii
+  3   utf-8    unicode61
+  4   utf-16   unicode61
+} {
+  reset_db
+
+  do_execsql_test 1.$tn.0 " 
+    PRAGMA encoding = '$enc'; 
+    CREATE VIRTUAL TABLE vt2 USING fts5(c0, c1, tokenize=$tok);
+  "
+
+  do_execsql_test 1.$tn.1 {
+    INSERT INTO vt2(c0, c1) VALUES ('bhal', x'17db');
+  }
+
+  do_execsql_test 1.$tn.2 {
+    UPDATE vt2 SET c0='bhal';
+  }
+
+  do_execsql_test 1.$tn.3 {
+    INSERT INTO vt2(vt2) VALUES('integrity-check')
+  }
+
+  do_execsql_test 1.$tn.4 {
+    SELECT quote(c1) FROM vt2
+  } {X'17DB'}
+}
 
 finish_test

Index: ext/misc/fileio.c
==================================================================
--- ext/misc/fileio.c
+++ ext/misc/fileio.c
@@ -90,17 +90,18 @@
 #if !defined(_WIN32) && !defined(WIN32)
 #  include <unistd.h>
 #  include <dirent.h>
 #  include <utime.h>
 #  include <sys/time.h>
+#  define STRUCT_STAT struct stat
 #else
 #  include "windows.h"
 #  include <io.h>
 #  include <direct.h>
 #  include "test_windirent.h"
 #  define dirent DIRENT
-#  define stat _stat
+#  define STRUCT_STAT struct _stat
 #  define chmod(path,mode) fileio_chmod(path,mode)
 #  define mkdir(path,mode) fileio_mkdir(path)
 #endif
 #include <time.h>
 #include <errno.h>
@@ -287,11 +288,11 @@
 ** buffer to UTC.  This is necessary on Win32, where the runtime library
 ** appears to return these values as local times.
 */
 static void statTimesToUtc(
   const char *zPath,
-  struct stat *pStatBuf
+  STRUCT_STAT *pStatBuf
 ){
   HANDLE hFindFile;
   WIN32_FIND_DATAW fd;
   LPWSTR zUnicodeName;
   extern LPWSTR sqlite3_win32_utf8_to_unicode(const char*);
@@ -315,11 +316,11 @@
 ** is required in order for the included time to be returned as UTC.  On all
 ** other systems, this function simply calls stat().
 */
 static int fileStat(
   const char *zPath,
-  struct stat *pStatBuf
+  STRUCT_STAT *pStatBuf
 ){
 #if defined(_WIN32)
   sqlite3_int64 sz = strlen(zPath);
   wchar_t *b1 = sqlite3_malloc64( (sz+1)*sizeof(b1[0]) );
   int rc;
@@ -339,11 +340,11 @@
 ** is required in order for the included time to be returned as UTC.  On all
 ** other systems, this function simply calls lstat().
 */
 static int fileLinkStat(
   const char *zPath,
-  struct stat *pStatBuf
+  STRUCT_STAT *pStatBuf
 ){
 #if defined(_WIN32)
   return fileStat(zPath, pStatBuf);
 #else
   return lstat(zPath, pStatBuf);
@@ -372,11 +373,11 @@
   }else{
     int nCopy = (int)strlen(zCopy);
     int i = 1;
 
     while( rc==SQLITE_OK ){
-      struct stat sStat;
+      STRUCT_STAT sStat;
       int rc2;
 
       for(; zCopy[i]!='/' && i<nCopy; i++);
       if( i==nCopy ) break;
       zCopy[i] = '\0';
@@ -422,11 +423,11 @@
       if( mkdir(zFile, mode) ){
         /* The mkdir() call to create the directory failed. This might not
         ** be an error though - if there is already a directory at the same
         ** path and either the permissions already match or can be changed
         ** to do so using chmod(), it is not an error.  */
-        struct stat sStat;
+        STRUCT_STAT sStat;
         if( errno!=EEXIST
          || 0!=fileStat(zFile, &sStat)
          || !S_ISDIR(sStat.st_mode)
          || ((sStat.st_mode&0777)!=(mode&0777) && 0!=chmod(zFile, mode&0777))
         ){
@@ -624,11 +625,11 @@
   FsdirLevel *aLvl;          /* Hierarchy of directories being traversed */
 
   const char *zBase;
   int nBase;
 
-  struct stat sStat;         /* Current lstat() results */
+  STRUCT_STAT sStat;         /* Current lstat() results */
   char *zPath;               /* Path to current entry */
   sqlite3_int64 iRowid;      /* Current rowid */
 };
 
 typedef struct fsdir_tab fsdir_tab;

Index: ext/rtree/rtree.c
==================================================================
--- ext/rtree/rtree.c
+++ ext/rtree/rtree.c
@@ -61,10 +61,12 @@
   SQLITE_EXTENSION_INIT1
 #else
   #include "sqlite3.h"
 #endif
 int sqlite3GetToken(const unsigned char*,int*); /* In the SQLite core */
+
+#include <stddef.h>
 
 /*
 ** If building separately, we will need some setup that is normally
 ** found in sqliteInt.h
 */

Index: ext/wasm/GNUmakefile
==================================================================
--- ext/wasm/GNUmakefile
+++ ext/wasm/GNUmakefile
@@ -408,11 +408,11 @@
 # JS/WASM build. They are solely for use with $(bin.c-pp) itself.
 #
 # -D... flags which should be included in all invocations should be
 # appended to $(SQLITE.CALL.C-PP.FILTER.global).
 bin.c-pp := ./c-pp
-$(bin.c-pp): c-pp.c $(sqlite3.c) $(MAKEFILE)
+$(bin.c-pp): c-pp.c $(sqlite3.c) # $(MAKEFILE)
 	$(CC) -O0 -o $@ c-pp.c $(sqlite3.c) '-DCMPP_DEFAULT_DELIM="//#"' -I$(dir.top) \
 		-DSQLITE_OMIT_LOAD_EXTENSION -DSQLITE_OMIT_DEPRECATED -DSQLITE_OMIT_UTF16 \
 		-DSQLITE_OMIT_SHARED_CACHE -DSQLITE_OMIT_WAL -DSQLITE_THREADSAFE=0 \
 		-DSQLITE_TEMP_STORE=3
 DISTCLEAN_FILES += $(bin.c-pp)
@@ -595,10 +595,13 @@
 ifeq (1,$(emcc.verbose))
 emcc.flags += -v
 # -v is _very_ loud but also informative about what it's doing
 endif
 
+
+# wasmMemory ==> required by our code for use with -sIMPORTED_MEMORY
+# Emscripten 4.0.7 (2025-04-15) stops exporting HEAP* by default
 ########################################################################
 # emcc flags for .c/.o.
 emcc.cflags :=
 emcc.cflags += -std=c99 -fPIC
 # -------------^^^^^^^^ we need c99 for $(sqlite3-wasm.c), primarily
@@ -613,12 +616,11 @@
 emcc.jsflags += -sMODULARIZE
 emcc.jsflags += -sDYNAMIC_EXECUTION=0
 emcc.jsflags += -sNO_POLYFILL
 emcc.jsflags += -sEXPORTED_FUNCTIONS=@$(EXPORTED_FUNCTIONS.api)
 emcc.exportedRuntimeMethods := \
-    -sEXPORTED_RUNTIME_METHODS=wasmMemory
-    # wasmMemory ==> required by our code for use with -sIMPORTED_MEMORY
+    -sEXPORTED_RUNTIME_METHODS=wasmMemory,HEAP8,HEAPU8,HEAP16,HEAPU16,HEAP32,HEAPU32,HEAP64,HEAPU64
 emcc.jsflags += $(emcc.exportedRuntimeMethods)
 emcc.jsflags += -sUSE_CLOSURE_COMPILER=0
 emcc.jsflags += -sIMPORTED_MEMORY
 ifeq (,$(filter -O0,$(emcc_opt)))
 emcc.assert ?= 0
@@ -1189,13 +1191,15 @@
     echo "SSH failed: it's likely that stale content will be served via old gzip files."
 
 ########################################################################
 # If we find a copy of the sqlite.org/wasm docs checked out, copy
 # certain files over to it, noting that some need automatable edits...
-wasm.docs.home ?= ../../../wasm
-wasm.docs.found = $(if $(wildcard $(wasm.docs.home)/api-index.md),\
-  $(wildcard $(wasm.docs.home)),)
+wasm.docs.home ?= $(firstword $(wildcard ../../../wasm $(HOME)/f/s/wasm))
+wasm.docs.found = $(if \
+  $(wildcard $(wasm.docs.home)/api-index.md),$(wildcard $(wasm.docs.home)),)
+# ^^^ don't split between the args there, else it can introduce an extra
+# space.
 .PHONY: update-docs
 ifeq (,$(wasm.docs.found))
 update-docs:
 	@echo "Cannot find wasm docs checkout."; \
 	echo "Pass wasm.docs.home=/path/to/wasm/docs/checkout or edit this makefile to suit."; \

Index: ext/wasm/api/sqlite3-wasm.c
==================================================================
--- ext/wasm/api/sqlite3-wasm.c
+++ ext/wasm/api/sqlite3-wasm.c
@@ -1155,11 +1155,11 @@
       unsigned char omit;
     } sqlite3_index_constraint_usage;
     { /* Validate that the above struct sizeof()s match
       ** expectations. We could improve upon this by
       ** checking the offsetof() for each member. */
-      const sqlite3_index_info siiCheck;
+      const sqlite3_index_info siiCheck = {0};
 #define IndexSzCheck(T,M)           \
       (sizeof(T) == sizeof(*siiCheck.M))
       if(!IndexSzCheck(sqlite3_index_constraint,aConstraint)
          || !IndexSzCheck(sqlite3_index_orderby,aOrderBy)
          || !IndexSzCheck(sqlite3_index_constraint_usage,aConstraintUsage)){

Index: ext/wasm/mkwasmbuilds.c
==================================================================
--- ext/wasm/mkwasmbuilds.c
+++ ext/wasm/mkwasmbuilds.c
@@ -326,11 +326,11 @@
   pf("\t\t$(pre-post-%s-%s.flags) \\\n", zNM);
   pf("\t\t$(emcc.flags.%s) $(emcc.flags.%s.%s) \\\n", zName, zNM);
   pf("\t\t$(cflags.common) $(SQLITE_OPT) \\\n"
      "\t\t$(cflags.%s) $(cflags.%s.%s) \\\n"
      "\t\t$(cflags.wasm_extra_init) $(sqlite3-wasm.cfiles)\n", zName, zNM);
-  if( LIBMODE_ESM & flags ){
+  if( (LIBMODE_ESM & flags) || (LIBMODE_NODEJS & flags) ){
     /* TODO? Replace this $(call) with the corresponding makefile
     ** code.  OTOH, we also use this $(call) in the speedtest1-wasmfs
     ** build, which is not part of the rules emitted by this
     ** program. */
     pf("\t@$(call SQLITE.CALL.xJS.ESM-EXPORT-DEFAULT,1,%d)\n",

Index: main.mk
==================================================================
--- main.mk
+++ main.mk
@@ -1832,10 +1832,16 @@
 mdevtest: srctree-check has_tclsh85
 	$(TCLSH_CMD) $(TOP)/test/testrunner.tcl mdevtest $(TSTRNNR_OPTS)
 
 sdevtest: has_tclsh85
 	$(TCLSH_CMD) $(TOP)/test/testrunner.tcl sdevtest $(TSTRNNR_OPTS)
+
+# Like releasetest, except it omits srctree-check and verify-source so
+# that it can be used on a modified source tree.
+#
+xdevtest: has_tclsh85
+	$(TCLSH_CMD) $(TOP)/test/testrunner.tcl release $(TSTRNNR_OPTS)
 
 #
 # Validate that various generated files in the source tree
 # are up-to-date.
 #

Index: src/bitvec.c
==================================================================
--- src/bitvec.c
+++ src/bitvec.c
@@ -214,11 +214,13 @@
     if( aiValues==0 ){
       return SQLITE_NOMEM_BKPT;
     }else{
       memcpy(aiValues, p->u.aHash, sizeof(p->u.aHash));
       memset(p->u.apSub, 0, sizeof(p->u.apSub));
-      p->iDivisor = (p->iSize + BITVEC_NPTR - 1)/BITVEC_NPTR;
+      p->iDivisor = p->iSize/BITVEC_NPTR;
+      if( (p->iSize%BITVEC_NPTR)!=0 ) p->iDivisor++;
+      if( p->iDivisor<BITVEC_NBIT ) p->iDivisor = BITVEC_NBIT;
       rc = sqlite3BitvecSet(p, i);
       for(j=0; j<BITVEC_NINT; j++){
         if( aiValues[j] ) rc |= sqlite3BitvecSet(p, aiValues[j]);
       }
       sqlite3StackFree(0, aiValues);

Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -3695,10 +3695,17 @@
  
     if( rc!=SQLITE_OK ){
       (void)sqlite3PagerWalWriteLock(pPager, 0);
       unlockBtreeIfUnused(pBt);
     }
+#if defined(SQLITE_ENABLE_SETLK_TIMEOUT)
+    if( rc==SQLITE_BUSY_TIMEOUT ){
+      /* If a blocking lock timed out, break out of the loop here so that
+      ** the busy-handler is not invoked.  */
+      break;
+    }
+#endif
   }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE &&
           btreeInvokeBusyHandler(pBt) );
   sqlite3PagerWalDb(pPager, 0);
 #ifdef SQLITE_ENABLE_SETLK_TIMEOUT
   if( rc==SQLITE_BUSY_TIMEOUT ) rc = SQLITE_BUSY;

Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -71,11 +71,13 @@
       assert( pExpr->iTable==pExpr->pLeft->x.pSelect->pEList->nExpr );
       return sqlite3ExprAffinity(
           pExpr->pLeft->x.pSelect->pEList->a[pExpr->iColumn].pExpr
       );
     }
-    if( op==TK_VECTOR ){
+    if( op==TK_VECTOR
+     || (op==TK_FUNCTION && pExpr->affExpr==SQLITE_AFF_DEFER)
+    ){
       assert( ExprUseXList(pExpr) );
       return sqlite3ExprAffinity(pExpr->x.pList->a[0].pExpr);
     }
     if( ExprHasProperty(pExpr, EP_Skip|EP_IfNullRow) ){
       assert( pExpr->op==TK_COLLATE
@@ -264,11 +266,13 @@
     }
     if( op==TK_CAST || op==TK_UPLUS ){
       p = p->pLeft;
       continue;
     }
-    if( op==TK_VECTOR ){
+    if( op==TK_VECTOR
+     || (op==TK_FUNCTION && p->affExpr==SQLITE_AFF_DEFER)
+    ){
       assert( ExprUseXList(p) );
       p = p->x.pList->a[0].pExpr;
       continue;
     }
     if( op==TK_COLLATE ){
@@ -7004,11 +7008,13 @@
   AggInfo *pAggInfo,   /* The AggInfo object to search and/or modify */
   Expr *pExpr          /* Expr describing the column to find or insert */
 ){
   struct AggInfo_col *pCol;
   int k;
+  int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
 
+  assert( mxTerm <= SMXV(i16) );
   assert( pAggInfo->iFirstReg==0 );
   pCol = pAggInfo->aCol;
   for(k=0; k<pAggInfo->nColumn; k++, pCol++){
     if( pCol->pCExpr==pExpr ) return;
     if( pCol->iTable==pExpr->iTable
@@ -7021,10 +7027,14 @@
   k = addAggInfoColumn(pParse->db, pAggInfo);
   if( k<0 ){
     /* OOM on resize */
     assert( pParse->db->mallocFailed );
     return;
+  }
+  if( k>mxTerm ){
+    sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
+    k = mxTerm;
   }
   pCol = &pAggInfo->aCol[k];
   assert( ExprUseYTab(pExpr) );
   pCol->pTab = pExpr->y.pTab;
   pCol->iTable = pExpr->iTable;
@@ -7055,10 +7065,11 @@
   assert( pExpr->pAggInfo==0 || pExpr->pAggInfo==pAggInfo );
   pExpr->pAggInfo = pAggInfo;
   if( pExpr->op==TK_COLUMN ){
     pExpr->op = TK_AGG_COLUMN;
   }
+  assert( k <= SMXV(pExpr->iAgg) );
   pExpr->iAgg = (i16)k;
 }
 
 /*
 ** This is the xExprCallback for a tree walker.  It is used to
@@ -7139,17 +7150,23 @@
       ){
         /* Check to see if pExpr is a duplicate of another aggregate
         ** function that is already in the pAggInfo structure
         */
         struct AggInfo_func *pItem = pAggInfo->aFunc;
+        int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+        assert( mxTerm <= SMXV(i16) );
         for(i=0; i<pAggInfo->nFunc; i++, pItem++){
           if( NEVER(pItem->pFExpr==pExpr) ) break;
           if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
             break;
           }
         }
-        if( i>=pAggInfo->nFunc ){
+        if( i>mxTerm ){
+          sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
+          i = mxTerm;
+          assert( i<pAggInfo->nFunc );
+        }else if( i>=pAggInfo->nFunc ){
           /* pExpr is original.  Make a new entry in pAggInfo->aFunc[]
           */
           u8 enc = ENC(pParse->db);
           i = addAggInfoFunc(pParse->db, pAggInfo);
           if( i>=0 ){
@@ -7199,10 +7216,11 @@
         }
         /* Make pExpr point to the appropriate pAggInfo->aFunc[] entry
         */
         assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
         ExprSetVVAProperty(pExpr, EP_NoReduce);
+        assert( i <= SMXV(pExpr->iAgg) );
         pExpr->iAgg = (i16)i;
         pExpr->pAggInfo = pAggInfo;
         return WRC_Prune;
       }else{
         return WRC_Continue;

Index: src/func.c
==================================================================
--- src/func.c
+++ src/func.c
@@ -1665,11 +1665,11 @@
   int argc,
   sqlite3_value **argv,
   int nSep,
   const char *zSep
 ){
-  i64 j, k, n = 0;
+  i64 j, n = 0;
   int i;
   char *z;
   for(i=0; i<argc; i++){
     n += sqlite3_value_bytes(argv[i]);
   }
@@ -1679,12 +1679,12 @@
     sqlite3_result_error_nomem(context);
     return;
   }
   j = 0;
   for(i=0; i<argc; i++){
-    k = sqlite3_value_bytes(argv[i]);
-    if( k>0 ){
+    if( sqlite3_value_type(argv[i])!=SQLITE_NULL ){
+      int k = sqlite3_value_bytes(argv[i]);
       const char *v = (const char*)sqlite3_value_text(argv[i]);
       if( v!=0 ){
         if( j>0 && nSep>0 ){
           memcpy(&z[j], zSep, nSep);
           j += nSep;

Index: src/json.c
==================================================================
--- src/json.c
+++ src/json.c
@@ -1283,12 +1283,14 @@
     nExtra = 0;
   }else if( szType==12 ){
     nExtra = 1;
   }else if( szType==13 ){
     nExtra = 2;
-  }else{
+  }else if( szType==14 ){
     nExtra = 4;
+  }else{
+    nExtra = 8;
   }
   if( szPayload<=11 ){
     nNeeded = 0;
   }else if( szPayload<=0xff ){
     nNeeded = 1;

Index: src/main.c
==================================================================
--- src/main.c
+++ src/main.c
@@ -1859,10 +1859,11 @@
 #ifdef SQLITE_ENABLE_API_ARMOR
   if( !sqlite3SafetyCheckOk(db) ) return SQLITE_MISUSE_BKPT;
 #endif
   if( ms<-1 ) return SQLITE_RANGE;
 #ifdef SQLITE_ENABLE_SETLK_TIMEOUT
+  sqlite3_mutex_enter(db->mutex);
   db->setlkTimeout = ms;
   db->setlkFlags = flags;
   sqlite3BtreeEnterAll(db);
   for(iDb=0; iDb<db->nDb; iDb++){
     Btree *pBt = db->aDb[iDb].pBt;
@@ -1870,10 +1871,11 @@
       sqlite3_file *fd = sqlite3PagerFile(sqlite3BtreePager(pBt));
       sqlite3OsFileControlHint(fd, SQLITE_FCNTL_BLOCK_ON_CONNECT, (void*)&bBOC);
     }
   }
   sqlite3BtreeLeaveAll(db);
+  sqlite3_mutex_leave(db->mutex);
 #endif
 #if !defined(SQLITE_ENABLE_API_ARMOR) && !defined(SQLITE_ENABLE_SETLK_TIMEOUT)
   UNUSED_PARAMETER(db);
   UNUSED_PARAMETER(flags);
 #endif

Index: src/os_unix.c
==================================================================
--- src/os_unix.c
+++ src/os_unix.c
@@ -5033,25 +5033,24 @@
   assert( pShmNode->hShm<0 || pDbFd->pInode->bProcessLock==0 );
 
   /* Check that, if this to be a blocking lock, no locks that occur later
   ** in the following list than the lock being obtained are already held:
   **
-  **   1. Checkpointer lock (ofst==1).
-  **   2. Write lock (ofst==0).
-  **   3. Read locks (ofst>=3 && ofst<SQLITE_SHM_NLOCK).
+  **   1. Recovery lock (ofst==2).
+  **   2. Checkpointer lock (ofst==1).
+  **   3. Write lock (ofst==0).
+  **   4. Read locks (ofst>=3 && ofst<SQLITE_SHM_NLOCK).
   **
   ** In other words, if this is a blocking lock, none of the locks that
   ** occur later in the above list than the lock being obtained may be
   ** held.
-  **
-  ** It is not permitted to block on the RECOVER lock.
   */
 #if defined(SQLITE_ENABLE_SETLK_TIMEOUT) && defined(SQLITE_DEBUG)
   {
     u16 lockMask = (p->exclMask|p->sharedMask);
     assert( (flags & SQLITE_SHM_UNLOCK) || pDbFd->iBusyTimeout==0 || (
-          (ofst!=2)                                   /* not RECOVER */
+          (ofst!=2 || lockMask==0)
        && (ofst!=1 || lockMask==0 || lockMask==2)
        && (ofst!=0 || lockMask<3)
        && (ofst<3  || lockMask<(1<<ofst))
     ));
   }

Index: src/os_win.c
==================================================================
--- src/os_win.c
+++ src/os_win.c
@@ -2720,11 +2720,15 @@
       DWORD nDelay = (nMs==0 ? INFINITE : nMs);
       DWORD res = osWaitForSingleObject(ovlp.hEvent, nDelay);
       if( res==WAIT_OBJECT_0 ){
         ret = TRUE;
       }else if( res==WAIT_TIMEOUT ){
+#if SQLITE_ENABLE_SETLK_TIMEOUT==1
         rc = SQLITE_BUSY_TIMEOUT;
+#else
+        rc = SQLITE_BUSY;
+#endif
       }else{
         /* Some other error has occurred */
         rc = SQLITE_IOERR_LOCK;
       }
 
@@ -4531,25 +4535,24 @@
   assert( n==1 || (flags & SQLITE_SHM_EXCLUSIVE)!=0 );
 
   /* Check that, if this to be a blocking lock, no locks that occur later
   ** in the following list than the lock being obtained are already held:
   **
-  **   1. Checkpointer lock (ofst==1).
-  **   2. Write lock (ofst==0).
-  **   3. Read locks (ofst>=3 && ofst<SQLITE_SHM_NLOCK).
+  **   1. Recovery lock (ofst==2).
+  **   2. Checkpointer lock (ofst==1).
+  **   3. Write lock (ofst==0).
+  **   4. Read locks (ofst>=3 && ofst<SQLITE_SHM_NLOCK).
   **
   ** In other words, if this is a blocking lock, none of the locks that
   ** occur later in the above list than the lock being obtained may be
   ** held.
-  **
-  ** It is not permitted to block on the RECOVER lock.
   */
 #if defined(SQLITE_ENABLE_SETLK_TIMEOUT) && defined(SQLITE_DEBUG)
   {
     u16 lockMask = (p->exclMask|p->sharedMask);
     assert( (flags & SQLITE_SHM_UNLOCK) || pDbFd->iBusyTimeout==0 || (
-          (ofst!=2)                                   /* not RECOVER */
+          (ofst!=2 || lockMask==0)
        && (ofst!=1 || lockMask==0 || lockMask==2)
        && (ofst!=0 || lockMask<3)
        && (ofst<3  || lockMask<(1<<ofst))
     ));
   }

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -698,10 +698,13 @@
   PCache *pPCache;            /* Pointer to page cache object */
 #ifndef SQLITE_OMIT_WAL
   Wal *pWal;                  /* Write-ahead log used by "journal_mode=wal" */
   char *zWal;                 /* File name for write-ahead log */
 #endif
+#ifdef SQLITE_ENABLE_SETLK_TIMEOUT
+  sqlite3 *dbWal;
+#endif
 };
 
 /*
 ** Indexes for use with Pager.aStat[]. The Pager.aStat[] array contains
 ** the values accessed by passing SQLITE_DBSTATUS_CACHE_HIT, CACHE_MISS
@@ -7579,10 +7582,15 @@
   if( rc==SQLITE_OK ){
     rc = sqlite3WalOpen(pPager->pVfs,
         pPager->fd, pPager->zWal, pPager->exclusiveMode,
         pPager->journalSizeLimit, &pPager->pWal
     );
+#ifdef SQLITE_ENABLE_SETLK_TIMEOUT
+    if( rc==SQLITE_OK ){
+      sqlite3WalDb(pPager->pWal, pPager->dbWal);
+    }
+#endif
   }
   pagerFixMaplimit(pPager);
 
   return rc;
 }
@@ -7698,10 +7706,11 @@
 /*
 ** Set the database handle used by the wal layer to determine if
 ** blocking locks are required.
 */
 void sqlite3PagerWalDb(Pager *pPager, sqlite3 *db){
+  pPager->dbWal = db;
   if( pagerUseWal(pPager) ){
     sqlite3WalDb(pPager->pWal, db);
   }
 }
 #endif

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -594,11 +594,11 @@
             "not present in both tables", zName);
           return 1;
         }
         pE1 = sqlite3CreateColumnExpr(db, pSrc, iLeft, iLeftCol);
         sqlite3SrcItemColumnUsed(&pSrc->a[iLeft], iLeftCol);
-        if( (pSrc->a[0].fg.jointype & JT_LTORJ)!=0 ){
+        if( (pSrc->a[0].fg.jointype & JT_LTORJ)!=0 && pParse->nErr==0 ){
           /* This branch runs if the query contains one or more RIGHT or FULL
           ** JOINs.  If only a single table on the left side of this join
           ** contains the zName column, then this branch is a no-op.
           ** But if there are two or more tables on the left side
           ** of the join, construct a coalesce() function that gathers all
@@ -610,10 +610,12 @@
           ** JOIN.  But older versions of SQLite do not do that, so we avoid
           ** adding a new error so as to not break legacy applications.
           */
           ExprList *pFuncArgs = 0;   /* Arguments to the coalesce() */
           static const Token tkCoalesce = { "coalesce", 8 };
+          assert( pE1!=0 );
+          ExprSetProperty(pE1, EP_CanBeNull);
           while( tableAndColumnIndex(pSrc, iLeft+1, i, zName, &iLeft, &iLeftCol,
                                      pRight->fg.isSynthUsing)!=0 ){
             if( pSrc->a[iLeft].fg.isUsing==0
              || sqlite3IdListIndex(pSrc->a[iLeft].u3.pUsing, zName)<0
             ){
@@ -626,11 +628,17 @@
             sqlite3SrcItemColumnUsed(&pSrc->a[iLeft], iLeftCol);
           }
           if( pFuncArgs ){
             pFuncArgs = sqlite3ExprListAppend(pParse, pFuncArgs, pE1);
             pE1 = sqlite3ExprFunction(pParse, pFuncArgs, &tkCoalesce, 0);
+            if( pE1 ){
+              pE1->affExpr = SQLITE_AFF_DEFER;
+            }
           }
+        }else if( (pSrc->a[i+1].fg.jointype & JT_LEFT)!=0 && pParse->nErr==0 ){
+          assert( pE1!=0 );
+          ExprSetProperty(pE1, EP_CanBeNull);
         }
         pE2 = sqlite3CreateColumnExpr(db, pSrc, i+1, iRightCol);
         sqlite3SrcItemColumnUsed(pRight, iRightCol);
         pEq = sqlite3PExpr(pParse, TK_EQ, pE1, pE2);
         assert( pE2!=0 || pEq==0 );
@@ -4234,13 +4242,13 @@
 **             other than the one FROM-clause subquery that is a candidate
 **             for flattening.  (This is due to ticket [2f7170d73bf9abf80]
 **             from 2015-02-09.)
 **
 **   (3)  If the subquery is the right operand of a LEFT JOIN then
-**        (3a) the subquery may not be a join and
-**        (3b) the FROM clause of the subquery may not contain a virtual
-**             table and
+**        (3a) the subquery may not be a join
+**        (**) Was (3b): "the FROM clause of the subquery may not contain
+**             a virtual table"
 **        (**) Was: "The outer query may not have a GROUP BY." This case
 **             is now managed correctly
 **        (3d) the outer query may not be DISTINCT.
 **        See also (26) for restrictions on RIGHT JOIN.
 **
@@ -4452,11 +4460,11 @@
   **
   ** See also tickets #306, #350, and #3300.
   */
   if( (pSubitem->fg.jointype & (JT_OUTER|JT_LTORJ))!=0 ){
     if( pSubSrc->nSrc>1                        /* (3a) */
-     || IsVirtual(pSubSrc->a[0].pSTab)         /* (3b) */
+     /**** || IsVirtual(pSubSrc->a[0].pSTab)      (3b)-omitted */
      || (p->selFlags & SF_Distinct)!=0         /* (3d) */
      || (pSubitem->fg.jointype & JT_RIGHT)!=0  /* (26) */
     ){
       return 0;
     }

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -4077,11 +4077,11 @@
 ** These interfaces are provided for use by [VFS shim] implementations and
 ** are not useful outside of that context.
 **
 ** The sqlite3_create_filename(D,J,W,N,P) allocates memory to hold a version of
 ** database filename D with corresponding journal file J and WAL file W and
-** with N URI parameters key/values pairs in the array P.  The result from
+** an array P of N URI Key/Value pairs.  The result from
 ** sqlite3_create_filename(D,J,W,N,P) is a pointer to a database filename that
 ** is safe to pass to routines like:
 ** <ul>
 ** <li> [sqlite3_uri_parameter()],
 ** <li> [sqlite3_uri_boolean()],
@@ -4758,11 +4758,11 @@
 ** KEYWORDS: {host parameter} {host parameters} {host parameter name}
 ** KEYWORDS: {SQL parameter} {SQL parameters} {parameter binding}
 ** METHOD: sqlite3_stmt
 **
 ** ^(In the SQL statement text input to [sqlite3_prepare_v2()] and its variants,
-** literals may be replaced by a [parameter] that matches one of following
+** literals may be replaced by a [parameter] that matches one of the following
 ** templates:
 **
 ** <ul>
 ** <li>  ?
 ** <li>  ?NNN
@@ -4803,11 +4803,11 @@
 ** either UTF8 if the sixth parameter is SQLITE_UTF8, or UTF16
 ** otherwise.
 **
 ** [[byte-order determination rules]] ^The byte-order of
 ** UTF16 input text is determined by the byte-order mark (BOM, U+FEFF)
-** found in first character, which is removed, or in the absence of a BOM
+** found in the first character, which is removed, or in the absence of a BOM
 ** the byte order is the native byte order of the host
 ** machine for sqlite3_bind_text16() or the byte order specified in
 ** the 6th parameter for sqlite3_bind_text64().)^
 ** ^If UTF16 input text contains invalid unicode
 ** characters, then SQLite might change those invalid characters
@@ -4823,11 +4823,11 @@
 ** the behavior is undefined.
 ** If a non-negative fourth parameter is provided to sqlite3_bind_text()
 ** or sqlite3_bind_text16() or sqlite3_bind_text64() then
 ** that parameter must be the byte offset
 ** where the NUL terminator would occur assuming the string were NUL
-** terminated.  If any NUL characters occurs at byte offsets less than
+** terminated.  If any NUL characters occur at byte offsets less than
 ** the value of the fourth parameter then the resulting string value will
 ** contain embedded NULs.  The result of expressions involving strings
 ** with embedded NULs is undefined.
 **
 ** ^The fifth argument to the BLOB and string binding interfaces controls
@@ -5035,11 +5035,11 @@
 /*
 ** CAPI3REF: Source Of Data In A Query Result
 ** METHOD: sqlite3_stmt
 **
 ** ^These routines provide a means to determine the database, table, and
-** table column that is the origin of a particular result column in
+** table column that is the origin of a particular result column in a
 ** [SELECT] statement.
 ** ^The name of the database or table or column can be returned as
 ** either a UTF-8 or UTF-16 string.  ^The _database_ routines return
 ** the database name, the _table_ routines return the table name, and
 ** the origin_ routines return the column name.
@@ -5604,12 +5604,12 @@
 ** within VIEWs, TRIGGERs, CHECK constraints, generated column expressions,
 ** index expressions, or the WHERE clause of partial indexes.
 **
 ** For best security, the [SQLITE_DIRECTONLY] flag is recommended for
 ** all application-defined SQL functions that do not need to be
-** used inside of triggers, view, CHECK constraints, or other elements of
-** the database schema.  This flags is especially recommended for SQL
+** used inside of triggers, views, CHECK constraints, or other elements of
+** the database schema.  This flag is especially recommended for SQL
 ** functions that have side effects or reveal internal application state.
 ** Without this flag, an attacker might be able to modify the schema of
 ** a database file to include invocations of the function with parameters
 ** chosen by the attacker, which the application will then execute when
 ** the database file is opened and read.
@@ -5636,11 +5636,11 @@
 ** or aggregate window function. More details regarding the implementation
 ** of aggregate window functions are
 ** [user-defined window functions|available here].
 **
 ** ^(If the final parameter to sqlite3_create_function_v2() or
-** sqlite3_create_window_function() is not NULL, then it is destructor for
+** sqlite3_create_window_function() is not NULL, then it is the destructor for
 ** the application data pointer. The destructor is invoked when the function
 ** is deleted, either by being overloaded or when the database connection
 ** closes.)^ ^The destructor is also invoked if the call to
 ** sqlite3_create_function_v2() fails.  ^When the destructor callback is
 ** invoked, it is passed a single argument which is a copy of the application
@@ -6036,11 +6036,11 @@
 /*
 ** CAPI3REF: Copy And Free SQL Values
 ** METHOD: sqlite3_value
 **
 ** ^The sqlite3_value_dup(V) interface makes a copy of the [sqlite3_value]
-** object D and returns a pointer to that copy.  ^The [sqlite3_value] returned
+** object V and returns a pointer to that copy.  ^The [sqlite3_value] returned
 ** is a [protected sqlite3_value] object even if the input is not.
 ** ^The sqlite3_value_dup(V) interface returns NULL if V is NULL or if a
 ** memory allocation fails. ^If V is a [pointer value], then the result
 ** of sqlite3_value_dup(V) is a NULL value.
 **
@@ -6074,11 +6074,11 @@
 ** ^The sqlite3_aggregate_context(C,N) routine returns a NULL pointer
 ** when first called if N is less than or equal to zero or if a memory
 ** allocation error occurs.
 **
 ** ^(The amount of space allocated by sqlite3_aggregate_context(C,N) is
-** determined by the N parameter on first successful call.  Changing the
+** determined by the N parameter on the first successful call.  Changing the
 ** value of N in any subsequent call to sqlite3_aggregate_context() within
 ** the same aggregate function instance will not resize the memory
 ** allocation.)^  Within the xFinal callback, it is customary to set
 ** N=0 in calls to sqlite3_aggregate_context(C,N) so that no
 ** pointless memory allocations occur.
@@ -6236,11 +6236,11 @@
 ** of as a secret key such that only code that knows the secret key is able
 ** to access the associated data.
 **
 ** Security Warning:  These interfaces should not be exposed in scripting
 ** languages or in other circumstances where it might be possible for an
-** an attacker to invoke them.  Any agent that can invoke these interfaces
+** attacker to invoke them.  Any agent that can invoke these interfaces
 ** can probably also take control of the process.
 ** 
 ** Database connection client data is only available for SQLite
 ** version 3.44.0 ([dateof:3.44.0]) and later.
 **
@@ -6350,11 +6350,11 @@
 ** ^If the 3rd parameter to the sqlite3_result_text* interfaces
 ** is non-negative, then as many bytes (not characters) of the text
 ** pointed to by the 2nd parameter are taken as the application-defined
 ** function result.  If the 3rd parameter is non-negative, then it
 ** must be the byte offset into the string where the NUL terminator would
-** appear if the string where NUL terminated.  If any NUL characters occur
+** appear if the string were NUL terminated.  If any NUL characters occur
 ** in the string at a byte offset that is less than the value of the 3rd
 ** parameter, then the resulting string will contain embedded NULs and the
 ** result of expressions operating on strings with embedded NULs is undefined.
 ** ^If the 4th parameter to the sqlite3_result_text* interfaces
 ** or sqlite3_result_blob is a non-NULL pointer, then SQLite calls that
@@ -6408,11 +6408,11 @@
 ** for the P parameter.  ^SQLite invokes D with P as its only argument
 ** when SQLite is finished with P.  The T parameter should be a static
 ** string and preferably a string literal. The sqlite3_result_pointer()
 ** routine is part of the [pointer passing interface] added for SQLite 3.20.0.
 **
-** If these routines are called from within the different thread
+** If these routines are called from within a different thread
 ** than the one containing the application-defined function that received
 ** the [sqlite3_context] pointer, the results are undefined.
 */
 void sqlite3_result_blob(sqlite3_context*, const void*, int, void(*)(void*));
 void sqlite3_result_blob64(sqlite3_context*,const void*,
@@ -6814,11 +6814,11 @@
 /*
 ** CAPI3REF: Return The Schema Name For A Database Connection
 ** METHOD: sqlite3
 **
 ** ^The sqlite3_db_name(D,N) interface returns a pointer to the schema name
-** for the N-th database on database connection D, or a NULL pointer of N is
+** for the N-th database on database connection D, or a NULL pointer if N is
 ** out of range.  An N value of 0 means the main database file.  An N of 1 is
 ** the "temp" schema.  Larger values of N correspond to various ATTACH-ed
 ** databases.
 **
 ** Space to hold the string that is returned by sqlite3_db_name() is managed
@@ -6909,20 +6909,20 @@
 **
 ** [[SQLITE_TXN_READ]] <dt>SQLITE_TXN_READ</dt>
 ** <dd>The SQLITE_TXN_READ state means that the database is currently
 ** in a read transaction.  Content has been read from the database file
 ** but nothing in the database file has changed.  The transaction state
-** will advanced to SQLITE_TXN_WRITE if any changes occur and there are
+** will be advanced to SQLITE_TXN_WRITE if any changes occur and there are
 ** no other conflicting concurrent write transactions.  The transaction
 ** state will revert to SQLITE_TXN_NONE following a [ROLLBACK] or
 ** [COMMIT].</dd>
 **
 ** [[SQLITE_TXN_WRITE]] <dt>SQLITE_TXN_WRITE</dt>
 ** <dd>The SQLITE_TXN_WRITE state means that the database is currently
 ** in a write transaction.  Content has been written to the database file
 ** but has not yet committed.  The transaction state will change to
-** to SQLITE_TXN_NONE at the next [ROLLBACK] or [COMMIT].</dd>
+** SQLITE_TXN_NONE at the next [ROLLBACK] or [COMMIT].</dd>
 */
 #define SQLITE_TXN_NONE  0
 #define SQLITE_TXN_READ  1
 #define SQLITE_TXN_WRITE 2
 
@@ -7199,11 +7199,11 @@
 
 /*
 ** CAPI3REF: Impose A Limit On Heap Size
 **
 ** These interfaces impose limits on the amount of heap memory that will be
-** by all database connections within a single process.
+** used by all database connections within a single process.
 **
 ** ^The sqlite3_soft_heap_limit64() interface sets and/or queries the
 ** soft limit on the amount of heap memory that may be allocated by SQLite.
 ** ^SQLite strives to keep heap memory utilization below the soft heap
 ** limit by reducing the number of pages held in the page cache
@@ -7257,11 +7257,11 @@
 **      by [sqlite3_config]([SQLITE_CONFIG_PAGECACHE],...) rather than
 **      from the heap.
 ** </ul>)^
 **
 ** The circumstances under which SQLite will enforce the heap limits may
-** changes in future releases of SQLite.
+** change in future releases of SQLite.
 */
 sqlite3_int64 sqlite3_soft_heap_limit64(sqlite3_int64 N);
 sqlite3_int64 sqlite3_hard_heap_limit64(sqlite3_int64 N);
 
 /*
@@ -7372,12 +7372,12 @@
 ** be tried also.
 **
 ** ^The entry point is zProc.
 ** ^(zProc may be 0, in which case SQLite will try to come up with an
 ** entry point name on its own.  It first tries "sqlite3_extension_init".
-** If that does not work, it constructs a name "sqlite3_X_init" where the
-** X is consists of the lower-case equivalent of all ASCII alphabetic
+** If that does not work, it constructs a name "sqlite3_X_init" where
+** X consists of the lower-case equivalent of all ASCII alphabetic
 ** characters in the filename from the last "/" to the first following
 ** "." and omitting any initial "lib".)^
 ** ^The sqlite3_load_extension() interface returns
 ** [SQLITE_OK] on success and [SQLITE_ERROR] if something goes wrong.
 ** ^If an error occurs and pzErrMsg is not 0, then the
@@ -7444,11 +7444,11 @@
 ** that is to be automatically loaded into all new database connections.
 **
 ** ^(Even though the function prototype shows that xEntryPoint() takes
 ** no arguments and returns void, SQLite invokes xEntryPoint() with three
 ** arguments and expects an integer result as if the signature of the
-** entry point where as follows:
+** entry point were as follows:
 **
 ** <blockquote><pre>
 ** &nbsp;  int xEntryPoint(
 ** &nbsp;    sqlite3 *db,
 ** &nbsp;    const char **pzErrMsg,
@@ -7608,11 +7608,11 @@
 ** and becomes the argvIndex-th entry in argv.  ^(If aConstraintUsage[].omit
 ** is true, then the constraint is assumed to be fully handled by the
 ** virtual table and might not be checked again by the byte code.)^ ^(The
 ** aConstraintUsage[].omit flag is an optimization hint. When the omit flag
 ** is left in its default setting of false, the constraint will always be
-** checked separately in byte code.  If the omit flag is change to true, then
+** checked separately in byte code.  If the omit flag is changed to true, then
 ** the constraint may or may not be checked in byte code.  In other words,
 ** when the omit flag is true there is no guarantee that the constraint will
 ** not be checked again using byte code.)^
 **
 ** ^The idxNum and idxStr values are recorded and passed into the
@@ -7634,11 +7634,11 @@
 ** will be returned by the strategy.
 **
 ** The xBestIndex method may optionally populate the idxFlags field with a
 ** mask of SQLITE_INDEX_SCAN_* flags. One such flag is
 ** [SQLITE_INDEX_SCAN_HEX], which if set causes the [EXPLAIN QUERY PLAN]
-** output to show the idxNum has hex instead of as decimal.  Another flag is
+** output to show the idxNum as hex instead of as decimal.  Another flag is
 ** SQLITE_INDEX_SCAN_UNIQUE, which if set indicates that the query plan will
 ** return at most one row.
 **
 ** Additionally, if xBestIndex sets the SQLITE_INDEX_SCAN_UNIQUE flag, then
 ** SQLite also assumes that if a call to the xUpdate() method is made as
@@ -7775,11 +7775,11 @@
 ** by the first parameter.  ^The name of the module is given by the
 ** second parameter.  ^The third parameter is a pointer to
 ** the implementation of the [virtual table module].   ^The fourth
 ** parameter is an arbitrary client data pointer that is passed through
 ** into the [xCreate] and [xConnect] methods of the virtual table module
-** when a new virtual table is be being created or reinitialized.
+** when a new virtual table is being created or reinitialized.
 **
 ** ^The sqlite3_create_module_v2() interface has a fifth parameter which
 ** is a pointer to a destructor for the pClientData.  ^SQLite will
 ** invoke the destructor function (if it is not NULL) when SQLite
 ** no longer needs the pClientData pointer.  ^The destructor will also
@@ -7940,11 +7940,11 @@
 **
 ** ^(On success, [SQLITE_OK] is returned and the new [BLOB handle] is stored
 ** in *ppBlob. Otherwise an [error code] is returned and, unless the error
 ** code is SQLITE_MISUSE, *ppBlob is set to NULL.)^ ^This means that, provided
 ** the API is not misused, it is always safe to call [sqlite3_blob_close()]
-** on *ppBlob after this function it returns.
+** on *ppBlob after this function returns.
 **
 ** This function fails with SQLITE_ERROR if any of the following are true:
 ** <ul>
 **   <li> ^(Database zDb does not exist)^,
 **   <li> ^(Table zTable does not exist within database zDb)^,
@@ -8060,11 +8060,11 @@
 ** CAPI3REF: Return The Size Of An Open BLOB
 ** METHOD: sqlite3_blob
 **
 ** ^Returns the size in bytes of the BLOB accessible via the
 ** successfully opened [BLOB handle] in its only argument.  ^The
-** incremental blob I/O routines can only read or overwriting existing
+** incremental blob I/O routines can only read or overwrite existing
 ** blob content; they cannot change the size of a blob.
 **
 ** This routine only works on a [BLOB handle] which has been created
 ** by a prior successful call to [sqlite3_blob_open()] and which has not
 ** been closed by [sqlite3_blob_close()].  Passing any other pointer in
@@ -8210,11 +8210,11 @@
 ** function that calls sqlite3_initialize().
 **
 ** ^The sqlite3_mutex_alloc() routine allocates a new
 ** mutex and returns a pointer to it. ^The sqlite3_mutex_alloc()
 ** routine returns NULL if it is unable to allocate the requested
-** mutex.  The argument to sqlite3_mutex_alloc() must one of these
+** mutex.  The argument to sqlite3_mutex_alloc() must be one of these
 ** integer constants:
 **
 ** <ul>
 ** <li>  SQLITE_MUTEX_FAST
 ** <li>  SQLITE_MUTEX_RECURSIVE
@@ -8443,11 +8443,11 @@
 
 /*
 ** CAPI3REF: Retrieve the mutex for a database connection
 ** METHOD: sqlite3
 **
-** ^This interface returns a pointer the [sqlite3_mutex] object that
+** ^This interface returns a pointer to the [sqlite3_mutex] object that
 ** serializes access to the [database connection] given in the argument
 ** when the [threading mode] is Serialized.
 ** ^If the [threading mode] is Single-thread or Multi-thread then this
 ** routine returns a NULL pointer.
 */
@@ -8566,11 +8566,11 @@
 
 /*
 ** CAPI3REF: SQL Keyword Checking
 **
 ** These routines provide access to the set of SQL language keywords
-** recognized by SQLite.  Applications can uses these routines to determine
+** recognized by SQLite.  Applications can use these routines to determine
 ** whether or not a specific identifier needs to be escaped (for example,
 ** by enclosing in double-quotes) so as not to confuse the parser.
 **
 ** The sqlite3_keyword_count() interface returns the number of distinct
 ** keywords understood by SQLite.
@@ -8734,11 +8734,11 @@
 **
 ** ^The [sqlite3_str_value(X)] method returns a pointer to the current
 ** content of the dynamic string under construction in X.  The value
 ** returned by [sqlite3_str_value(X)] is managed by the sqlite3_str object X
 ** and might be freed or altered by any subsequent method on the same
-** [sqlite3_str] object.  Applications must not used the pointer returned
+** [sqlite3_str] object.  Applications must not use the pointer returned by
 ** [sqlite3_str_value(X)] after any subsequent method call on the same
 ** object.  ^Applications may change the content of the string returned
 ** by [sqlite3_str_value(X)] as long as they do not write into any bytes
 ** outside the range of 0 to [sqlite3_str_length(X)] and do not read or
 ** write any byte after any subsequent sqlite3_str method call.
@@ -8820,11 +8820,11 @@
 ** ^(<dt>SQLITE_STATUS_PAGECACHE_OVERFLOW</dt>
 ** <dd>This parameter returns the number of bytes of page cache
 ** allocation which could not be satisfied by the [SQLITE_CONFIG_PAGECACHE]
 ** buffer and where forced to overflow to [sqlite3_malloc()].  The
 ** returned value includes allocations that overflowed because they
-** where too large (they were larger than the "sz" parameter to
+** were too large (they were larger than the "sz" parameter to
 ** [SQLITE_CONFIG_PAGECACHE]) and allocations that overflowed because
 ** no space was left in the page cache.</dd>)^
 **
 ** [[SQLITE_STATUS_PAGECACHE_SIZE]] ^(<dt>SQLITE_STATUS_PAGECACHE_SIZE</dt>
 ** <dd>This parameter records the largest memory allocation request
@@ -8904,53 +8904,55 @@
 ** checked out.</dd>)^
 **
 ** [[SQLITE_DBSTATUS_LOOKASIDE_HIT]] ^(<dt>SQLITE_DBSTATUS_LOOKASIDE_HIT</dt>
 ** <dd>This parameter returns the number of malloc attempts that were
 ** satisfied using lookaside memory. Only the high-water value is meaningful;
-** the current value is always zero.)^
+** the current value is always zero.</dd>)^
 **
 ** [[SQLITE_DBSTATUS_LOOKASIDE_MISS_SIZE]]
 ** ^(<dt>SQLITE_DBSTATUS_LOOKASIDE_MISS_SIZE</dt>
-** <dd>This parameter returns the number malloc attempts that might have
+** <dd>This parameter returns the number of malloc attempts that might have
 ** been satisfied using lookaside memory but failed due to the amount of
 ** memory requested being larger than the lookaside slot size.
 ** Only the high-water value is meaningful;
-** the current value is always zero.)^
+** the current value is always zero.</dd>)^
 **
 ** [[SQLITE_DBSTATUS_LOOKASIDE_MISS_FULL]]
 ** ^(<dt>SQLITE_DBSTATUS_LOOKASIDE_MISS_FULL</dt>
-** <dd>This parameter returns the number malloc attempts that might have
+** <dd>This parameter returns the number of malloc attempts that might have
 ** been satisfied using lookaside memory but failed due to all lookaside
 ** memory already being in use.
 ** Only the high-water value is meaningful;
-** the current value is always zero.)^
+** the current value is always zero.</dd>)^
 **
 ** [[SQLITE_DBSTATUS_CACHE_USED]] ^(<dt>SQLITE_DBSTATUS_CACHE_USED</dt>
 ** <dd>This parameter returns the approximate number of bytes of heap
 ** memory used by all pager caches associated with the database connection.)^
 ** ^The highwater mark associated with SQLITE_DBSTATUS_CACHE_USED is always 0.
+** </dd>
 **
 ** [[SQLITE_DBSTATUS_CACHE_USED_SHARED]]
 ** ^(<dt>SQLITE_DBSTATUS_CACHE_USED_SHARED</dt>
 ** <dd>This parameter is similar to DBSTATUS_CACHE_USED, except that if a
 ** pager cache is shared between two or more connections the bytes of heap
 ** memory used by that pager cache is divided evenly between the attached
 ** connections.)^  In other words, if none of the pager caches associated
 ** with the database connection are shared, this request returns the same
-** value as DBSTATUS_CACHE_USED. Or, if one or more or the pager caches are
+** value as DBSTATUS_CACHE_USED. Or, if one or more of the pager caches are
 ** shared, the value returned by this call will be smaller than that returned
 ** by DBSTATUS_CACHE_USED. ^The highwater mark associated with
-** SQLITE_DBSTATUS_CACHE_USED_SHARED is always 0.
+** SQLITE_DBSTATUS_CACHE_USED_SHARED is always 0.</dd>
 **
 ** [[SQLITE_DBSTATUS_SCHEMA_USED]] ^(<dt>SQLITE_DBSTATUS_SCHEMA_USED</dt>
 ** <dd>This parameter returns the approximate number of bytes of heap
 ** memory used to store the schema for all databases associated
 ** with the connection - main, temp, and any [ATTACH]-ed databases.)^
 ** ^The full amount of memory used by the schemas is reported, even if the
 ** schema memory is shared with other database connections due to
 ** [shared cache mode] being enabled.
 ** ^The highwater mark associated with SQLITE_DBSTATUS_SCHEMA_USED is always 0.
+** </dd>
 **
 ** [[SQLITE_DBSTATUS_STMT_USED]] ^(<dt>SQLITE_DBSTATUS_STMT_USED</dt>
 ** <dd>This parameter returns the approximate number of bytes of heap
 ** and lookaside memory used by all prepared statements associated with
 ** the database connection.)^
@@ -8983,11 +8985,11 @@
 ** [[SQLITE_DBSTATUS_CACHE_SPILL]] ^(<dt>SQLITE_DBSTATUS_CACHE_SPILL</dt>
 ** <dd>This parameter returns the number of dirty cache entries that have
 ** been written to disk in the middle of a transaction due to the page
 ** cache overflowing. Transactions are more efficient if they are written
 ** to disk all at once. When pages spill mid-transaction, that introduces
-** additional overhead. This parameter can be used help identify
+** additional overhead. This parameter can be used to help identify
 ** inefficiencies that can be resolved by increasing the cache size.
 ** </dd>
 **
 ** [[SQLITE_DBSTATUS_DEFERRED_FKS]] ^(<dt>SQLITE_DBSTATUS_DEFERRED_FKS</dt>
 ** <dd>This parameter returns zero for the current value if and only if
@@ -9463,11 +9465,11 @@
 ** sqlite3_backup_step(), the source database may be modified mid-way
 ** through the backup process.  ^If the source database is modified by an
 ** external process or via a database connection other than the one being
 ** used by the backup operation, then the backup will be automatically
 ** restarted by the next call to sqlite3_backup_step(). ^If the source
-** database is modified by the using the same database connection as is used
+** database is modified by using the same database connection as is used
 ** by the backup operation, then the backup database is automatically
 ** updated at the same time.
 **
 ** [[sqlite3_backup_finish()]] <b>sqlite3_backup_finish()</b>
 **
@@ -9480,11 +9482,11 @@
 ** active write-transaction on the destination database is rolled back.
 ** The [sqlite3_backup] object is invalid
 ** and may not be used following a call to sqlite3_backup_finish().
 **
 ** ^The value returned by sqlite3_backup_finish is [SQLITE_OK] if no
-** sqlite3_backup_step() errors occurred, regardless or whether or not
+** sqlite3_backup_step() errors occurred, regardless of whether or not
 ** sqlite3_backup_step() completed.
 ** ^If an out-of-memory condition or IO error occurred during any prior
 ** sqlite3_backup_step() call on the same [sqlite3_backup] object, then
 ** sqlite3_backup_finish() returns the corresponding [error code].
 **
@@ -10519,18 +10521,18 @@
 int sqlite3_stmt_scanstatus(
   sqlite3_stmt *pStmt,      /* Prepared statement for which info desired */
   int idx,                  /* Index of loop to report on */
   int iScanStatusOp,        /* Information desired.  SQLITE_SCANSTAT_* */
   void *pOut                /* Result written here */
-);    
+);
 int sqlite3_stmt_scanstatus_v2(
   sqlite3_stmt *pStmt,      /* Prepared statement for which info desired */
   int idx,                  /* Index of loop to report on */
   int iScanStatusOp,        /* Information desired.  SQLITE_SCANSTAT_* */
   int flags,                /* Mask of flags defined below */
   void *pOut                /* Result written here */
-);    
+);
 
 /*
 ** CAPI3REF: Prepared Statement Scan Status
 ** KEYWORDS: {scan status flags}
 */
@@ -10550,11 +10552,11 @@
 /*
 ** CAPI3REF: Flush caches to disk mid-transaction
 ** METHOD: sqlite3
 **
 ** ^If a write-transaction is open on [database connection] D when the
-** [sqlite3_db_cacheflush(D)] interface invoked, any dirty
+** [sqlite3_db_cacheflush(D)] interface is invoked, any dirty
 ** pages in the pager-cache that are not currently in use are written out
 ** to disk. A dirty page may be in use if a database cursor created by an
 ** active SQL statement is reading from it, or if it is page 1 of a database
 ** file (page 1 is always "in use").  ^The [sqlite3_db_cacheflush(D)]
 ** interface flushes caches for all schemas - "main", "temp", and

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -1029,12 +1029,12 @@
 /*
 ** Macro SMXV(n) return the maximum value that can be held in variable n,
 ** assuming n is a signed integer type.  UMXV(n) is similar for unsigned
 ** integer types.
 */
-#define SMXV(n) ((((i64)1)<<(sizeof(n)-1))-1)
-#define UMXV(n) ((((i64)1)<<(sizeof(n)))-1)
+#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
+#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
 
 /*
 ** Round up a number to the next larger multiple of 8.  This is used
 ** to force 8-byte alignment on 64-bit architectures.
 **
@@ -2327,10 +2327,11 @@
 #define SQLITE_AFF_TEXT     0x42  /* 'B' */
 #define SQLITE_AFF_NUMERIC  0x43  /* 'C' */
 #define SQLITE_AFF_INTEGER  0x44  /* 'D' */
 #define SQLITE_AFF_REAL     0x45  /* 'E' */
 #define SQLITE_AFF_FLEXNUM  0x46  /* 'F' */
+#define SQLITE_AFF_DEFER    0x58  /* 'X'  - defer computation until later */
 
 #define sqlite3IsNumericAffinity(X)  ((X)>=SQLITE_AFF_NUMERIC)
 
 /*
 ** The SQLITE_AFF_MASK values masks off the significant bits of an
@@ -2877,21 +2878,21 @@
 struct AggInfo {
   u8 directMode;          /* Direct rendering mode means take data directly
                           ** from source tables rather than from accumulators */
   u8 useSortingIdx;       /* In direct mode, reference the sorting index rather
                           ** than the source table */
-  u16 nSortingColumn;     /* Number of columns in the sorting index */
+  u32 nSortingColumn;     /* Number of columns in the sorting index */
   int sortingIdx;         /* Cursor number of the sorting index */
   int sortingIdxPTab;     /* Cursor number of pseudo-table */
   int iFirstReg;          /* First register in range for aCol[] and aFunc[] */
   ExprList *pGroupBy;     /* The group by clause */
   struct AggInfo_col {    /* For each column used in source tables */
     Table *pTab;             /* Source table */
     Expr *pCExpr;            /* The original expression */
     int iTable;              /* Cursor number of the source table */
-    i16 iColumn;             /* Column number within the source table */
-    i16 iSorterColumn;       /* Column number in the sorting index */
+    int iColumn;             /* Column number within the source table */
+    int iSorterColumn;       /* Column number in the sorting index */
   } *aCol;
   int nColumn;            /* Number of used entries in aCol[] */
   int nAccumulator;       /* Number of columns that show through to the output.
                           ** Additional columns are used only as parameters to
                           ** aggregate functions */

Index: src/vdbesort.c
==================================================================
--- src/vdbesort.c
+++ src/vdbesort.c
@@ -967,11 +967,11 @@
   assert( pCsr->pKeyInfo );
   assert( !pCsr->isEphemeral );
   assert( pCsr->eCurType==CURTYPE_SORTER );
   assert( sizeof(KeyInfo) + UMXV(pCsr->pKeyInfo->nKeyField)*sizeof(CollSeq*)
                < 0x7fffffff );
-  szKeyInfo = SZ_KEYINFO(pCsr->pKeyInfo->nKeyField+1);
+  szKeyInfo = SZ_KEYINFO(pCsr->pKeyInfo->nKeyField);
   sz = SZ_VDBESORTER(nWorker+1);
 
   pSorter = (VdbeSorter*)sqlite3DbMallocZero(db, sz + szKeyInfo);
   pCsr->uc.pSorter = pSorter;
   if( pSorter==0 ){

Index: src/wal.c
==================================================================
--- src/wal.c
+++ src/wal.c
@@ -3060,11 +3060,10 @@
     assert( rc==SQLITE_OK );
     if( pWal->bShmUnreliable==0 ){
       rc = walIndexReadHdr(pWal, pChanged);
     }
 #ifdef SQLITE_ENABLE_SETLK_TIMEOUT
-    walDisableBlocking(pWal);
     if( rc==SQLITE_BUSY_TIMEOUT ){
       rc = SQLITE_BUSY;
       *pCnt |= WAL_RETRY_BLOCKED_MASK;
     }
 #endif
@@ -3075,10 +3074,11 @@
       ** which might cause WAL_RETRY to be returned even if BUSY_RECOVERY
       ** would be technically correct.  But the race is benign since with
       ** WAL_RETRY this routine will be called again and will probably be
       ** right on the second iteration.
       */
+      (void)walEnableBlocking(pWal);
       if( pWal->apWiData[0]==0 ){
         /* This branch is taken when the xShmMap() method returns SQLITE_BUSY.
         ** We assume this is a transient condition, so return WAL_RETRY. The
         ** xShmMap() implementation used by the default unix and win32 VFS
         ** modules may return SQLITE_BUSY due to a race condition in the
@@ -3091,10 +3091,11 @@
         rc = WAL_RETRY;
       }else if( rc==SQLITE_BUSY ){
         rc = SQLITE_BUSY_RECOVERY;
       }
     }
+    walDisableBlocking(pWal);
     if( rc!=SQLITE_OK ){
       return rc;
     }
     else if( pWal->bShmUnreliable ){
       return walBeginShmUnreliable(pWal, pChanged);
@@ -3778,10 +3779,11 @@
         rc = xUndo(pUndoCtx, walFramePgno(pWal, iFrame));
       }
       if( iMax!=pWal->hdr.mxFrame ) walCleanupHash(pWal);
     }
     SEH_EXCEPT( rc = SQLITE_IOERR_IN_PAGE; )
+    pWal->iReCksum = 0;
   }
   return rc;
 }
 
 /*
@@ -3825,10 +3827,13 @@
     pWal->hdr.aFrameCksum[1] = aWalData[2];
     SEH_TRY {
       walCleanupHash(pWal);
     }
     SEH_EXCEPT( rc = SQLITE_IOERR_IN_PAGE; )
+    if( pWal->iReCksum>pWal->hdr.mxFrame ){
+      pWal->iReCksum = 0;
+    }
   }
 
   return rc;
 }
 

Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -2199,16 +2199,17 @@
     }
 
     if( pLevel->iLeftJoin==0 ){
       /* If a partial index is driving the loop, try to eliminate WHERE clause
       ** terms from the query that must be true due to the WHERE clause of
-      ** the partial index.
+      ** the partial index.  This optimization does not work on an outer join,
+      ** as shown by:
       **
-      ** 2019-11-02 ticket 623eff57e76d45f6: This optimization does not work
-      ** for a LEFT JOIN.
+      ** 2019-11-02 ticket 623eff57e76d45f6      (LEFT JOIN)
+      ** 2025-05-29 forum post 7dee41d32506c4ae  (RIGHT JOIN)
       */
-      if( pIdx->pPartIdxWhere ){
+      if( pIdx->pPartIdxWhere && pLevel->pRJ==0 ){
         whereApplyPartialIndexConstraints(pIdx->pPartIdxWhere, iCur, pWC);
       }
     }else{
       testcase( pIdx->pPartIdxWhere );
       /* The following assert() is not a requirement, merely an observation:

Index: src/whereexpr.c
==================================================================
--- src/whereexpr.c
+++ src/whereexpr.c
@@ -929,34 +929,46 @@
 ** column references.  This routine checks to see if pExpr is an equivalence
 ** relation:
 **   1.  The SQLITE_Transitive optimization must be enabled
 **   2.  Must be either an == or an IS operator
 **   3.  Not originating in the ON clause of an OUTER JOIN
-**   4.  The affinities of A and B must be compatible
-**   5a. Both operands use the same collating sequence OR
-**   5b. The overall collating sequence is BINARY
+**   4.  The operator is not IS or else the query does not contain RIGHT JOIN
+**   5.  The affinities of A and B must be compatible
+**   6a. Both operands use the same collating sequence OR
+**   6b. The overall collating sequence is BINARY
 ** If this routine returns TRUE, that means that the RHS can be substituted
 ** for the LHS anyplace else in the WHERE clause where the LHS column occurs.
 ** This is an optimization.  No harm comes from returning 0.  But if 1 is
 ** returned when it should not be, then incorrect answers might result.
 */
-static int termIsEquivalence(Parse *pParse, Expr *pExpr){
+static int termIsEquivalence(Parse *pParse, Expr *pExpr, SrcList *pSrc){
   char aff1, aff2;
   CollSeq *pColl;
-  if( !OptimizationEnabled(pParse->db, SQLITE_Transitive) ) return 0;
-  if( pExpr->op!=TK_EQ && pExpr->op!=TK_IS ) return 0;
-  if( ExprHasProperty(pExpr, EP_OuterON) ) return 0;
+  if( !OptimizationEnabled(pParse->db, SQLITE_Transitive) ) return 0;  /* (1) */
+  if( pExpr->op!=TK_EQ && pExpr->op!=TK_IS ) return 0;                 /* (2) */
+  if( ExprHasProperty(pExpr, EP_OuterON) ) return 0;                   /* (3) */
+  assert( pSrc!=0 );
+  if( pExpr->op==TK_IS
+   && pSrc->nSrc
+   && (pSrc->a[0].fg.jointype & JT_LTORJ)!=0
+  ){
+    return 0;                                                          /* (4) */
+  }
   aff1 = sqlite3ExprAffinity(pExpr->pLeft);
   aff2 = sqlite3ExprAffinity(pExpr->pRight);
   if( aff1!=aff2
    && (!sqlite3IsNumericAffinity(aff1) || !sqlite3IsNumericAffinity(aff2))
   ){
-    return 0;
+    return 0;                                                          /* (5) */
   }
   pColl = sqlite3ExprCompareCollSeq(pParse, pExpr);
-  if( sqlite3IsBinary(pColl) ) return 1;
-  return sqlite3ExprCollSeqMatch(pParse, pExpr->pLeft, pExpr->pRight);
+  if( !sqlite3IsBinary(pColl)
+   && !sqlite3ExprCollSeqMatch(pParse, pExpr->pLeft, pExpr->pRight)
+  ){
+    return 0;                                                          /* (6) */
+  }
+  return 1;
 }
 
 /*
 ** Recursively walk the expressions of a SELECT statement and generate
 ** a bitmask indicating which tables are used in that expression
@@ -1217,12 +1229,12 @@
         pNew = &pWC->a[idxNew];
         markTermAsChild(pWC, idxNew, idxTerm);
         if( op==TK_IS ) pNew->wtFlags |= TERM_IS;
         pTerm = &pWC->a[idxTerm];
         pTerm->wtFlags |= TERM_COPIED;
-
-        if( termIsEquivalence(pParse, pDup) ){
+        assert( pWInfo->pTabList!=0 );
+        if( termIsEquivalence(pParse, pDup, pWInfo->pTabList) ){
           pTerm->eOperator |= WO_EQUIV;
           eExtraOp = WO_EQUIV;
         }
       }else{
         pDup = pExpr;

Index: test/fts3join.test
==================================================================
--- test/fts3join.test
+++ test/fts3join.test
@@ -95,13 +95,10 @@
       SELECT docid, * FROM ft4 WHERE ft4 MATCH ?
   ) AS rr ON t4.rowid=rr.docid 
   WHERE t4.y = ?;
 } {
   QUERY PLAN
-  |--MATERIALIZE rr
-  |  `--SCAN ft4 VIRTUAL TABLE INDEX 3:
   |--SCAN t4
-  |--BLOOM FILTER ON rr (docid=?)
-  `--SEARCH rr USING AUTOMATIC COVERING INDEX (docid=?) LEFT-JOIN
+  `--SCAN ft4 VIRTUAL TABLE INDEX 3: LEFT-JOIN
 }
 
 finish_test

Index: test/func9.test
==================================================================
--- test/func9.test
+++ test/func9.test
@@ -24,10 +24,13 @@
   SELECT concat();
 } {1 {wrong number of arguments to function concat()}}
 do_execsql_test func9-130 {
   SELECT concat_ws(',',1,2,3,4,5,6,7,8,NULL,9,10,11,12);
 } {1,2,3,4,5,6,7,8,9,10,11,12}
+do_execsql_test func9-131 {
+  SELECT concat_ws(',',1,2,3,4,'',6,7,8,NULL,9,10,11,12);
+} {1,2,3,4,,6,7,8,9,10,11,12}
 do_execsql_test func9-140 {
   SELECT concat_ws(NULL,1,2,3,4,5,6,7,8,NULL,9,10,11,12);
 } {{}}
 do_catchsql_test func9-150 {
   SELECT concat_ws();

Index: test/join.test
==================================================================
--- test/join.test
+++ test/join.test
@@ -999,10 +999,25 @@
 } {}
 do_execsql_test join-20.2 {
   CREATE INDEX t1x ON t1(0) WHERE NULL IN (c1);
   SELECT * FROM t0 LEFT JOIN t1 WHERE NULL IN (c1);
 } {}
+
+# 2025-05-29 forum post 7dee41d32506c4ae
+# The complaint in the forum post appears to be the same as for the
+# ticket on 2019-11-02, only for RIGHT JOIN instead of LEFT JOIN.  Note
+# that RIGHT JOIN did not yet exist in SQLite when the ticket was
+# written and fixed.
+#
+do_execsql_test join-20.3 {
+  DROP TABLE t1;
+  CREATE TABLE t1(x INT);      INSERT INTO t1(x) VALUES(1);
+  CREATE TABLE t2(y BOOLEAN);  INSERT INTO t2(y) VALUES(false);
+  CREATE TABLE t3(z INT);      INSERT INTO t3(z) VALUES(3);
+  CREATE INDEX t2y ON t2(y) WHERE y;
+  SELECT quote(z) FROM t1 RIGHT JOIN t2 ON y LEFT JOIN t3 ON y;
+} {NULL}
 
 # 2019-11-30 ticket 7f39060a24b47353
 # Do not allow a WHERE clause term to qualify a partial index on the
 # right table of a LEFT JOIN.
 #
@@ -1286,7 +1301,72 @@
 do_execsql_test join-30.3 {
   SELECT DISTINCT a, b
     FROM t0 JOIN t1 ON z=a RIGHT JOIN t2 ON a=b LEFT JOIN v5 ON false
    WHERE x <= y;
 } {}
+
+# 2025-05-30 https://sqlite.org/forum/forumpost/4fc70203b61c7e12
+#
+# When converting a USING(x) or NATURAL into the constraint expression
+# t1.x==t2.x, mark the t1.x term as EP_CanBeNull if it is the left table
+# of a RIGHT JOIN.
+#
+reset_db
+db null NULL
+do_execsql_test join-31.1 {
+  CREATE TABLE t1(c0 INT , c1 INT); INSERT INTO t1(c0, c1) VALUES(NULL,11);
+  CREATE TABLE t2(c0 INT NOT NULL);
+  CREATE TABLE t2n(c0 INT);
+  CREATE TABLE t3(x INT);           INSERT INTO t3(x) VALUES(3);
+  CREATE TABLE t4(y INT);           INSERT INTO t4(y) VALUES(4);
+  CREATE TABLE t5(c0 INT, x INT);   INSERT INTO t5 VALUES(NULL, 5);
+}
+do_execsql_test join-31.2 {
+  SELECT * FROM t2 RIGHT JOIN t3 ON true LEFT JOIN t1 USING(c0);
+} {NULL 3 NULL}
+do_execsql_test join-31.3 {
+  SELECT * FROM t2 RIGHT JOIN t3 ON true NATURAL LEFT JOIN t1;
+} {NULL 3 NULL}
+do_execsql_test join-31.4 {
+  SELECT * FROM t2n RIGHT JOIN t3 ON true LEFT JOIN t1 USING(c0);
+} {NULL 3 NULL}
+do_execsql_test join-31.5 {
+  SELECT * FROM t5 LEFT JOIN t1 USING(c0);
+} {NULL 5 NULL}
+do_execsql_test join-31.6 {
+  SELECT * FROM t3 LEFT JOIN t2 ON true LEFT JOIN t1 USING(c0);
+} {3 NULL NULL}
+do_execsql_test join-31.7 {
+  SELECT * FROM t3 LEFT JOIN t2 ON true NATURAL LEFT JOIN t1;
+} {3 NULL NULL}
+do_execsql_test join-31.8 {
+  SELECT * FROM t3 LEFT JOIN t2 ON true JOIN t4 ON true NATURAL LEFT JOIN t1;
+} {3 NULL 4 NULL}
+
+# 2025-06-16 https://sqlite.org/forum/forumpost/68f29a2005
+#
+# The transitive-constraint optimization was not working for RIGHT JOIN.
+#
+reset_db
+db null NULL
+do_execsql_test join-32.1 {
+  CREATE TABLE t0(w INT);
+  CREATE TABLE t1(x INT);
+  CREATE TABLE t2(y INT UNIQUE);
+  CREATE VIEW v0(z) AS SELECT CAST(x AS INT) FROM t1 LEFT JOIN t2 ON true;
+  INSERT INTO t1(x) VALUES(123);
+  INSERT INTO t2(y) VALUES(NULL);
+}
+do_execsql_test join-32.2 {
+  SELECT *
+  FROM t0 JOIN v0 ON w=z
+          RIGHT JOIN t1 ON true
+          INNER JOIN t2 ON y IS z;
+} {NULL NULL 123 NULL}
+do_execsql_test join-32.3 {
+  SELECT *
+  FROM t0 JOIN v0 ON w=z
+          RIGHT JOIN t1 ON true
+          INNER JOIN t2 ON +y IS z;
+} {NULL NULL 123 NULL}
 
 finish_test

Index: test/joinH.test
==================================================================
--- test/joinH.test
+++ test/joinH.test
@@ -338,7 +338,77 @@
 } {NULL NULL 1 -592 4 192 16 48}
 do_execsql_test 13.4 {
   SELECT sum( a1.a+a1.b ) FROM t3 AS a1 RIGHT JOIN t3 ON true
    GROUP BY a1.a ORDER BY 1;
 } {-1480 240 480}
+
+#-------------------------------------------------------------------------
+# 2025-05-30
+# https://sqlite.org/forum/forumpost/5028c785b6
+#
+reset_db
+
+do_execsql_test 14.0 {
+  CREATE TABLE t1(c0 INT);
+  CREATE TABLE t2(c0 BLOB);
+  CREATE TABLE t3(c0 BLOB);
+  CREATE TABLE t4(c4 BLOB);
+  INSERT INTO t1(c0) VALUES(0);
+  INSERT INTO t3(c0) VALUES('0');
+}
+
+do_execsql_test 14.1.1 {
+  SELECT * FROM t1 NATURAL LEFT JOIN t2 NATURAL JOIN t3;
+} {0}
+
+do_execsql_test 14.1.2 {
+  SELECT * FROM t1 NATURAL LEFT JOIN t2 NATURAL JOIN t3 FULL JOIN t4 ON true;
+} {0 {}}
+
+do_execsql_test 14.1.3 {
+  SELECT * FROM (t1 NATURAL LEFT JOIN t2 NATURAL JOIN t3) FULL JOIN t4 ON true;
+} {0 {}}
+
+do_execsql_test 14.1.4 {
+  SELECT * 
+  FROM (t1 NATURAL LEFT JOIN t2 NATURAL JOIN t3) AS qq FULL JOIN t4 ON true;
+} {0 {}}
+
+do_execsql_test 14.2.1 {
+  SELECT * FROM t3 NATURAL LEFT JOIN t2 NATURAL JOIN t1;
+} {0}
+
+do_execsql_test 14.2.2 {
+  SELECT * FROM t3 NATURAL LEFT JOIN t2 NATURAL JOIN t1 FULL JOIN t4 ON true;
+} {0 {}}
+
+do_execsql_test 14.2.3 {
+  SELECT * FROM (t3 NATURAL LEFT JOIN t2 NATURAL JOIN t1) FULL JOIN t4 ON true;
+} {0 {}}
+
+do_execsql_test 14.2.4 {
+  SELECT * 
+  FROM (t3 NATURAL LEFT JOIN t2 NATURAL JOIN t1) AS qq FULL JOIN t4 ON true;
+} {0 {}}
+
+# 2025-06-01 
+#
+reset_db
+do_execsql_test 15.1 {
+  CREATE TABLE t0(c0);
+  CREATE TABLE t1(c0);
+  CREATE TABLE t2(c0);
+  INSERT INTO t0 VALUES ('1.0');
+  INSERT INTO t2(c0) VALUES (9);
+  SELECT t0.c0,t2.c0 FROM (SELECT CAST(t0.c0 as REAL) AS c0 FROM t0) as subquery NATURAL LEFT JOIN t1  NATURAL JOIN t0  RIGHT JOIN t2 ON 1;
+} {1.0 9}
+do_execsql_test 15.2 {
+  CREATE TABLE x1(x COLLATE nocase);
+  CREATE TABLE x2(x);
+  CREATE TABLE x3(x);
+  CREATE TABLE t4(y);
+  INSERT INTO x1 VALUES('ABC');
+  INSERT INTO x3 VALUES('abc');
+  SELECT lower(x), quote(y) FROM x1 LEFT JOIN x2 USING (x) JOIN x3 USING (x) FULL JOIN t4;
+} {abc NULL}
 
 finish_test

Index: test/snapshot3.test
==================================================================
--- test/snapshot3.test
+++ test/snapshot3.test
@@ -93,10 +93,13 @@
 
 do_test 1.8 {
   execsql BEGIN db3
   list [catch { sqlite3_snapshot_open_blob db3 main $snap } msg] $msg
 } {1 SQLITE_ERROR_SNAPSHOT}
+
+db3 close
+db2 close
 
 #-------------------------------------------------------------------------
 reset_db
 do_execsql_test 2.0 {
   PRAGMA journal_mode = wal;

Index: test/walcksum.test
==================================================================
--- test/walcksum.test
+++ test/walcksum.test
@@ -14,10 +14,11 @@
 source $testdir/tester.tcl
 source $testdir/lock_common.tcl
 source $testdir/wal_common.tcl
 
 ifcapable !wal {finish_test ; return }
+set testprefix walcksum
 
 # Read and return the contents of file $filename. Treat the content as
 # binary data.
 #
 proc readfile {filename} {
@@ -328,8 +329,155 @@
     SELECT count(*) FROM t1;
   } db2
 } {ok 256}
 catch { db close }
 catch { db2 close }
+
+#-------------------------------------------------------------------------
+# Test cases based on the bug reported at:
+# 
+#    <https://sqlite.org/forum/forumpost/b490f726db>
+#
+reset_db
+
+do_execsql_test 3.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA synchronous = NORMAL;
+  PRAGMA journal_mode = WAL;
+  PRAGMA cache_size = 1;
+
+  CREATE TABLE t1 (i INTEGER PRIMARY KEY, b BLOB, t TEXT);
+  PRAGMA wal_checkpoint;
+  INSERT INTO t1 VALUES(1, randomblob(2048), 'one');
+} {wal 0 2 2}
+
+do_execsql_test 3.1 {
+  BEGIN;
+    INSERT INTO t1 VALUES(2, randomblob(2048), 'two');
+    SAVEPOINT one;
+    INSERT INTO t1 VALUES(3, randomblob(2048), 'three');
+    INSERT INTO t1 VALUES(4, randomblob(2048), 'four');
+    INSERT INTO t1 VALUES(5, randomblob(2048), 'five');
+    INSERT INTO t1 VALUES(6, randomblob(2048), 'six');
+    INSERT INTO t1 VALUES(7, randomblob(2048), 'seven');
+
+    UPDATE t1 SET b=randomblob(2048) WHERE i=5;
+    UPDATE t1 SET b=randomblob(2048) WHERE i=6;
+    UPDATE t1 SET b=randomblob(2048) WHERE i=7;
+    ROLLBACK TO one;
+    INSERT INTO t1 VALUES(8, NULL, 'eight');
+  COMMIT;
+} {}
+
+do_execsql_test 3.2 {
+  SELECT i, t FROM t1
+} {1 one   2 two   8 eight}
+
+forcecopy test.db test2.db
+forcecopy test.db-wal test2.db-wal
+
+sqlite3 db2 test2.db
+do_test 1.3 {
+  execsql {
+    SELECT i, t FROM t1
+  } db2
+} {1 one   2 two   8 eight}
+
+catch { db2 close }
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 4.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA synchronous = NORMAL;
+  PRAGMA journal_mode = WAL;
+  PRAGMA cache_size = 1;
+
+  CREATE TABLE t1 (i INTEGER PRIMARY KEY, b BLOB, t TEXT);
+  PRAGMA wal_checkpoint;
+  INSERT INTO t1 VALUES(1, randomblob(2048), 'one');
+} {wal 0 2 2}
+
+do_execsql_test 4.1.1 {
+  SAVEPOINT one;
+    INSERT INTO t1 VALUES(2, randomblob(2048), 'two');
+    INSERT INTO t1 VALUES(3, randomblob(2048), 'three');
+    INSERT INTO t1 VALUES(4, randomblob(2048), 'four');
+    INSERT INTO t1 VALUES(5, randomblob(2048), 'five');
+    INSERT INTO t1 VALUES(6, randomblob(2048), 'six');
+    INSERT INTO t1 VALUES(7, randomblob(2048), 'seven');
+
+    UPDATE t1 SET b=randomblob(2048) WHERE i=5;
+    UPDATE t1 SET b=randomblob(2048) WHERE i=6;
+    UPDATE t1 SET b=randomblob(2048) WHERE i=7;
+}
+
+do_execsql_test 4.1.2 {
+    ROLLBACK TO one;
+    INSERT INTO t1 VALUES(8, NULL, 'eight');
+  RELEASE one;
+} {}
+
+do_execsql_test 4.2 {
+  SELECT i, t FROM t1
+} {1 one   8 eight}
+
+forcecopy test.db test2.db
+forcecopy test.db-wal test2.db-wal
+
+sqlite3 db2 test2.db
+do_test 4.3 {
+  execsql {
+    SELECT i, t FROM t1
+  } db2
+} {1 one   8 eight}
+
+catch { db2 close }
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 5.0 {
+  PRAGMA auto_vacuum = 0;
+  PRAGMA synchronous = NORMAL;
+  PRAGMA journal_mode = WAL;
+  PRAGMA cache_size = 1;
+
+  CREATE TABLE t1 (i INTEGER PRIMARY KEY, b BLOB, t TEXT);
+  INSERT INTO t1 VALUES(1, randomblob(2048), 'one');
+  INSERT INTO t1 VALUES(2, randomblob(2048), 'two');
+  INSERT INTO t1 VALUES(3, randomblob(2048), 'three');
+  PRAGMA wal_checkpoint;
+} {wal 0 14 14}
+
+do_execsql_test 5.1 {
+  BEGIN;
+    SELECT count(*) FROM t1;
+    SAVEPOINT one;
+    INSERT INTO t1 VALUES(4, randomblob(2048), 'four');
+    INSERT INTO t1 VALUES(5, randomblob(2048), 'five');
+    INSERT INTO t1 VALUES(6, randomblob(2048), 'six');
+    INSERT INTO t1 VALUES(7, randomblob(2048), 'seven');
+    ROLLBACK TO one;
+    INSERT INTO t1 VALUES(8, randomblob(2048), 'eight');
+    INSERT INTO t1 VALUES(9, randomblob(2048), 'nine');
+  COMMIT;
+} {3}
+
+forcecopy test.db test2.db
+forcecopy test.db-wal test2.db-wal
+
+sqlite3 db2 test2.db
+do_test 5.2 {
+  execsql {
+    SELECT i, t FROM t1
+  } db2
+} {1 one  2 two   3 three  8 eight 9 nine}
+db2 close
+
+do_execsql_test 5.3 {
+  SELECT i, t FROM t1
+} {1 one  2 two   3 three  8 eight 9 nine}
 
   
 finish_test

Index: test/walsetlk2.test
==================================================================
--- test/walsetlk2.test
+++ test/walsetlk2.test
@@ -88,10 +88,12 @@
 #-------------------------------------------------------------------------
 # Check that if sqlite3_setlk_timeout() is used, blocking locks timeout
 # but other operations do not use the retry mechanism.
 #
 reset_db
+db close
+sqlite3 db test.db -fullmutex 1
 
 do_execsql_test 2.0 {
   CREATE TABLE t1(a, b);
   INSERT INTO t1 VALUES(1, 2), (3, 4);
 }

ADDED   test/walsetlk_recover.test
Index: test/walsetlk_recover.test
==================================================================
--- /dev/null
+++ test/walsetlk_recover.test
@@ -0,0 +1,104 @@
+# 2025 May 30
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# TESTRUNNER: slow
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/lock_common.tcl
+set testprefix walsetlk_recover
+
+ifcapable !wal {finish_test ; return }
+# ifcapable !setlk_timeout {finish_test ; return }
+
+do_execsql_test 1.0 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(a, b);
+  INSERT INTO t1 VALUES(1, 2);
+  INSERT INTO t1 VALUES(3, 4);
+  INSERT INTO t1 VALUES(5, 6);
+} {wal}
+
+db_save_and_close
+db_restore
+
+testfixture_nb myvar {
+
+  testvfs tvfs -fullshm 1
+  sqlite3 db test.db -vfs tvfs
+  tvfs script vfs_callback
+  tvfs filter xRead
+
+  set ::done 0
+  proc vfs_callback {method file args} {
+    if {$::done==0 && [string match *wal $file]} {
+      after 4000
+      set ::done 1
+    }
+    return "SQLITE_OK"
+  }
+
+  db eval {
+    SELECT * FROM t1
+  }
+
+  db close
+}
+
+# Give the [testfixture_nb] command time to start
+after 1000 {set xyz 1}
+vwait xyz
+
+testvfs tvfs -fullshm 1
+sqlite3 db test.db -vfs tvfs
+
+tvfs script sleep_callback
+tvfs filter xSleep
+set ::sleep_count 0
+proc sleep_callback {args} {
+  incr ::sleep_count
+}
+
+sqlite3 db test.db -vfs tvfs
+db timeout 500
+set tm [lindex [time {
+  catch {
+    db eval {SELECT * FROM t1}
+  } msg
+}] 0]
+
+do_test 1.2         { set ::msg } {database is locked}
+do_test 1.3.($::tm) { expr $::tm>400000 && $::tm<2000000 } 1
+
+vwait myvar
+
+do_execsql_test 1.4 {
+  SELECT * FROM t1
+} {1 2 3 4 5 6}
+
+db close
+tvfs delete
+
+# All SQLite builds should pass the tests above. SQLITE_ENABLE_SETLK_TIMEOUT=1
+# builds do so without calling the VFS xSleep method.
+if {$::sqlite_options(setlk_timeout)==1} {
+  do_test 1.5.1 {
+    set ::sleep_count
+  } 0
+} else {
+  do_test 1.5.2 {
+    expr $::sleep_count>0
+  } 1
+}
+
+finish_test
+

ADDED   test/walsetlk_snapshot.test
Index: test/walsetlk_snapshot.test
==================================================================
--- /dev/null
+++ test/walsetlk_snapshot.test
@@ -0,0 +1,109 @@
+# 2025 May 30
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# TESTRUNNER: slow
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/lock_common.tcl
+set testprefix walsetlk_snapshot
+
+ifcapable !wal {finish_test ; return }
+ifcapable !snapshot {finish_test; return}
+
+db close
+testvfs tvfs -fullshm 1
+sqlite3 db test.db -vfs tvfs
+tvfs script sleep_callback
+tvfs filter xSleep
+set ::sleep_count 0
+proc sleep_callback {args} {
+  incr ::sleep_count
+}
+
+do_execsql_test 1.0 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(a, b);
+  INSERT INTO t1 VALUES(1, 2);
+  INSERT INTO t1 VALUES(3, 4);
+  INSERT INTO t1 VALUES(5, 6);
+} {wal}
+
+do_test 1.1 {
+  db eval BEGIN
+  set ::snap [sqlite3_snapshot_get db main]
+  db eval {
+    INSERT INTO t1 VALUES(7, 8);
+    COMMIT;
+  }
+} {}
+
+testfixture_nb myvar {
+
+  testvfs tvfs -fullshm 1
+  sqlite3 db test.db -vfs tvfs
+  tvfs script vfs_callback
+  tvfs filter {xWrite}
+
+  set ::done 0
+  proc vfs_callback {args} {
+    if {$::done==0} {
+      after 4000
+      set ::done 1
+    }
+    return "SQLITE_OK"
+  }
+
+  db eval {
+    PRAGMA wal_checkpoint;
+  }
+
+  db close
+}
+
+# Give the [testfixture_nb] command time to start
+after 1000 {set xyz 1}
+vwait xyz
+
+db timeout 500
+set tm [lindex [time {
+  catch {
+    db eval BEGIN
+      sqlite3_snapshot_open db main $::snap
+  } msg
+}] 0]
+
+do_test 1.2 { set ::msg } {SQLITE_BUSY}
+do_test 1.3.($::tm) { expr $::tm<2000000 } 1
+
+do_execsql_test 1.4 {
+  SELECT * FROM t1
+} {1 2 3 4 5 6 7 8}
+
+sqlite3_snapshot_free $::snap
+
+vwait myvar
+
+# All SQLite builds should pass the tests above. SQLITE_ENABLE_SETLK_TIMEOUT=1
+# builds do so without calling the VFS xSleep method.
+if {$::sqlite_options(setlk_timeout)==1} {
+  do_test 1.5.1 {
+    set ::sleep_count
+  } 0
+} else {
+  do_test 1.5.2 {
+    expr $::sleep_count>0
+  } 1
+}
+
+finish_test
+

Index: tool/sqlite3_rsync.c
==================================================================
--- tool/sqlite3_rsync.c
+++ tool/sqlite3_rsync.c
@@ -1536,11 +1536,11 @@
           sqlite3_finalize(pCkHash);
           sqlite3_finalize(pCkHashN);
           sqlite3_finalize(pInsHash);
           pCkHash = 0;
           pInsHash = 0;
-          if( mxHash<p->nPage ){
+          if( mxHash<=p->nPage ){
             runSql(p, "WITH RECURSIVE c(n) AS"
                       " (VALUES(%d) UNION ALL SELECT n+1 FROM c WHERE n<%d)"
                       " INSERT INTO badHash SELECT n, 1 FROM c",
                       mxHash, p->nPage);
           }