test: scope SQLite-deadlock workarounds to the still-affected surface

Local verification 2026-04-23 with SQLite 3.51.3 (rusqlite 0.39):
- perima-db tests: 5/5 PASS, 0 hangs, 8s each. The upstream lock-order
  inversion fix in unixClose vs unixLock-from-sqlite3WalClose is
  sufficient for our writer + read-pool single-writer fixture.
- perima-desktop integration tests: 7/12 STILL deadlock at 80s. The
  `_inner` test seam (run_scan_inner_with_metadata + list_files_inner +
  search_inner + 4 others) opens its own short-lived writer + ReadPool
  per call, and tests that chain multiple `_inner` calls hit a SECOND
  close-ordering surface that 3.51.3 does not address. Per the research
  doc, "fix the symptom, not the class": the bug class (multiple
  Connections to same file with non-deterministic drop ordering) still
  exists, just no longer via the upstream-patched path.

Workarounds reverted (SQLite fix is sufficient):
- nextest.toml: drop perima-db retries=2 override (5/5 verified clean).
- nextest.toml: drop perima-desktop slow-timeout=90s override (the
  perceived "slow tests" were actually deadlocked under 3.51.1).

Workarounds RESTORED on the still-affected surface:
- 7 #[ignore] attributes on the affected commands_test.rs tests, with
  a tighter WHY pointing at the remaining bug class + the migration
  off _inner seam tracked in #119/#126.

Net effect: cleaner config + targeted test-skip. Matches the research
recommendation tier-1 (rusqlite bump) without false-claim cleanup.

Author: utof

.config/nextest.toml

@@ -2,33 +2,11 @@
 # https://nexte.st/docs/configuration/
 
 [profile.default]
-# Default: flag a test as "slow" after 40s and terminate after two slow
-# periods (80s total per test). Rationale: the slowest clean test in
-# perima-{db,app,cli,core,fs,hash,media} is ~14s (fts proptest). Past
-# 40s is a sign of lock contention or deadlock, not legitimate compute.
-# Per-package overrides below relax this for crates with legitimately
-# slow tests (perima-desktop = real Tauri/scan/thumbnail work).
+# Flag a test as "slow" after 40s and terminate after two slow periods
+# (80s total per test). Rationale: the slowest clean test in any crate
+# is ~14s (fts proptest in perima-db). Past 40s is a sign of lock
+# contention or deadlock, not legitimate compute. nextest 0.9.133 lacks
+# a CLI `--slow-timeout` flag, but honors this config key — keeps
+# `timeout NNN cargo nextest ...` wrappers from killing the whole suite
+# on a single hang.
 slow-timeout = { period = "40s", terminate-after = 2 }
-
-# perima-desktop integration tests (`crates/desktop/tests/commands_test.rs`)
-# do real end-to-end scan + metadata + thumbnail work via the `_inner`
-# helpers. On macOS CI runners these can take 60-90s legitimately; per
-# CLAUDE.md baseline `cargo nextest run -p perima-desktop` is 120-300s
-# (Tauri compile + slow tests). Bumping to 90s × 2 = 180s before kill.
-# The deadlock-detection signal stays at 80s for every other crate.
-[[profile.default.overrides]]
-filter = 'package(perima-desktop)'
-slow-timeout = { period = "90s", terminate-after = 2 }
-
-# perima-db tests intermittently hit the SQLite lock-order inversion
-# documented in GH #131 (writer + ReadPool drop race within a single
-# test process). Local reproduction: ~20% per-run hang on the FTS5
-# proptests; macOS CI also surfaced it on plain repo tests like
-# `tag_repo::tests::upsert_tag_inserts_new`. cargo nextest's
-# process-per-test isolation eliminates the cross-test class but not
-# the within-test class. Retry up to 2 times → effective per-test
-# failure rate <1% (0.2³ if independent). Removal pending GH #131
-# production fix or migration off the per-test writer+pool fixture.
-[[profile.default.overrides]]
-filter = 'package(perima-db)'
-retries = 2

crates/desktop/tests/commands_test.rs

@@ -72,11 +72,8 @@ fn write_tiny_png(path: &Path, fill: [u8; 3]) {
 }
 
 /// Scan three fixture files and assert `files_seen=3, files_new=3, files_errored=0`.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan`. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn scan_indexes_files() {
     let fixture_dir = tempfile::tempdir().expect("tempdir for fixtures");
     let data_dir = tempfile::tempdir().expect("tempdir for data");
@@ -114,17 +111,8 @@ async fn scan_indexes_files() {
 }
 
 /// After a successful scan, `list_files_inner` must return all 3 records.
-///
-/// WHY ignored on CI: hits the `SQLite` lock-order inversion in `unixClose` vs
-/// `unixLock`-from-`sqlite3WalClose` (GH #131). Test creates writer + read
-/// pool against a single DB; at end-of-test the writer thread + pool drop
-/// concurrently and the lock-order cycle deadlocks. Tracked locally via gdb
-/// backtrace 2026-04-23. Run manually with `cargo nextest run --run-ignored
-/// only -p perima-desktop` if you have a kernel + libc combination immune
-/// to the upstream race. Removal pending #131 production fix or migration
-/// off the `_inner` test seam (#119/#126).
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn list_files_after_scan() {
     let fixture_dir = tempfile::tempdir().expect("tempdir for fixtures");
     let data_dir = tempfile::tempdir().expect("tempdir for data");
@@ -149,11 +137,8 @@ async fn list_files_after_scan() {
 /// After inserting metadata for a scanned file, the
 /// `list_files_with_metadata_inner` helper must return at least one row
 /// with metadata fields populated from the stored record.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan` above. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn list_files_with_metadata_returns_rows() {
     let fixture_dir = tempfile::tempdir().expect("tempdir for fixtures");
     let data_dir = tempfile::tempdir().expect("tempdir for data");
@@ -235,11 +220,8 @@ async fn list_files_with_metadata_returns_rows() {
 }
 
 /// After a successful scan, `list_volumes_inner` must return at least one volume.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan`. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn list_volumes_after_scan() {
     let fixture_dir = tempfile::tempdir().expect("tempdir for fixtures");
     let data_dir = tempfile::tempdir().expect("tempdir for data");
@@ -261,11 +243,8 @@ async fn list_volumes_after_scan() {
 /// PNG files must produce `file_metadata` rows AND WebP thumbnails on
 /// disk under `<data_dir>/thumbnails/` — the same subtree the Tauri
 /// asset-protocol scope exposes.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan` above. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn desktop_scan_populates_metadata_and_thumbnails() {
     let fixture_dir = tempfile::tempdir().expect("tempdir for fixtures");
     let data_dir = tempfile::tempdir().expect("tempdir for data");
@@ -366,11 +345,8 @@ async fn desktop_scan_populates_metadata_and_thumbnails() {
 
 /// Exercises the four tag `_inner` helpers end-to-end:
 /// attach → list-with-tags → list-tags → detach → verify empty.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan`. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn list_files_with_tags_returns_tagged_rows() {
     let td = tempfile::tempdir().expect("tempdir");
     let data_dir = td.path().join("data");
@@ -506,11 +482,8 @@ fn thumbnail_root_matches_asset_protocol_scope() {
 /// via the `SearchRepository` trait, and asserts the query returns the
 /// seeded filename. Exercises the inner helper end-to-end without
 /// constructing `tauri::State`.
-///
-/// WHY ignored on CI: same `SQLite` lock-order deadlock as
-/// `list_files_after_scan`. See GH #131.
 #[tokio::test]
-#[ignore = "GH #131 — SQLite lock-order inversion deadlocks under concurrent Connection drops"]
+#[ignore = "GH #131 — desktop _inner test seam still deadlocks under SQLite 3.51.3 (separate close-ordering surface, not the upstream-fixed lock-order inversion). Tracked for migration off _inner seam in #119/#126."]
 async fn search_returns_hit_after_scan_and_rebuild() {
     let td = tempfile::tempdir().expect("tempdir");
     let data_dir = td.path().join("data");