Merge pull request #130 from utof/architecture-audit/v0.6.x

arch-audit checkpoint: Batches A→E landed + SQLite deadlock fixed

78 commits: 61 checkpoint (Batches A/B/C/D/E of the architecture-audit
umbrella) + 17 fixes surfaced during CI validation.

Fixes on top of the checkpoint:
- Arc::clone → .clone() on unsize coercion sites (74e3865)
- 11 latent clippy errors + bindings_compile assertion scope (d8e1561, 0f1db29)
- cargo-nextest adoption (closes #121) + repo-wide no-cargo-test enforcement (04ecb43)
- cargo-nextest install in CI (466a41a)
- nextest slow-timeout + retry tuning, iterated (7db4266, e53cb65, 8c74f39)
- rusqlite 0.38 → 0.39 (bundled SQLite 3.51.1 → 3.51.3) — closes the
  upstream lock-order inversion documented in #131 (8dc4156, 3fec391)
- Application-level drop-order fix in run_scan_inner_with_metadata:
  all sender clones dropped before writer.join() (GRDB.swift #739
  pattern). 7 previously-deadlocking desktop tests now pass in 335ms.
  (4bc301b, 4680561)

Follow-up trackers filed:
- #131 updated with resolution (SQLite lib bug + app-level drop-order).
- #132 Dependabot setup for cargo + bun + actions.
- #133 remove [patch.crates-io] for refinery once PR #425 ships.

Branch stays open for Batch F onwards.

[skip ci]

Author: utof

.config/nextest.toml

@@ -0,0 +1,12 @@
+# cargo-nextest configuration
+# https://nexte.st/docs/configuration/
+
+[profile.default]
+# Flag a test as "slow" after 40s and terminate after two slow periods
+# (80s total per test). Rationale: the slowest clean test in any crate
+# is ~14s (fts proptest in perima-db). Past 40s is a sign of lock
+# contention or deadlock, not legitimate compute. nextest 0.9.133 lacks
+# a CLI `--slow-timeout` flag, but honors this config key — keeps
+# `timeout NNN cargo nextest ...` wrappers from killing the whole suite
+# on a single hang.
+slow-timeout = { period = "40s", terminate-after = 2 }

.github/workflows/ci.yml

@@ -29,12 +29,17 @@ jobs:
 
       - uses: taiki-e/install-action@just
 
-      # WHY: `just ci` runs `cargo deny check` and `typos`. Both are
-      # external binaries — neither ships with the Rust toolchain. Using
-      # taiki-e/install-action fetches prebuilt binaries (seconds) rather
-      # than `cargo install` (minutes), which matters on the 3-OS matrix.
+      # WHY: `just ci` runs `cargo deny check`, `typos`, and
+      # `cargo nextest run`. All three are external binaries — none ship
+      # with the Rust toolchain. Using taiki-e/install-action fetches
+      # prebuilt binaries (seconds) rather than `cargo install` (minutes),
+      # which matters on the 3-OS matrix. Nextest swap landed in commit
+      # adopting `cargo nextest run` workspace-wide (closes #121) — the
+      # SQLite lock-order inversion that `cargo test` reproduces ~20% is
+      # documented in CLAUDE.md + GH #131.
       - uses: taiki-e/install-action@cargo-deny
       - uses: taiki-e/install-action@typos
+      - uses: taiki-e/install-action@cargo-nextest
 
       - uses: actions/setup-node@v4
         with:
@@ -61,3 +66,36 @@ jobs:
       - name: Run just ci
         shell: bash
         run: just ci
+
+  bindings-drift:
+    name: bindings.ts drift check
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: taiki-e/install-action@just
+
+      # WHY: same Tauri Linux deps as the matrix job's Linux branch —
+      # tauri-build links against GTK3 + WebKit2GTK on Linux.
+      - name: Install Tauri Linux deps
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq \
+            libgtk-3-dev \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      # WHY: regenerate bindings.ts via the specta-export feature and
+      # fail the job if `git diff` shows the committed copy is stale.
+      # Catches every Rust-side change to a #[tauri::command] signature,
+      # a specta-derived type, or a CoreError variant that wasn't paired
+      # with a bindings.ts commit.
+      - name: Bindings drift check
+        run: just bindings