Reject scan --workers below 1 as a usage error (closes #10)

A --workers value of 0 or less used to be quietly raised to 1, so a
typo ran the whole scan on one worker with nothing on stderr to say
why. scan now refuses it before anything is scanned: one line on
stderr and exit 2, like the other usage errors. The clamp in runScan
is gone, and README states the rule and the default.

Model: opus-5-5

Dockerfile

@@ -51,14 +51,21 @@ RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \
 FROM golang@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS builder
 
 # We never build or run as root. Create an unprivileged user and point
-# HOME and the Go caches at its home so go build and go test can write
-# their caches when we drop to it below. $GOPATH/bin is deliberately not
-# on PATH: script/bootstrap no longer `go install`s anything (the linter
-# runs from a pinned image, never from a host install), so nothing lands
+# HOME and the build cache at its home so go build and go test can write
+# it when we drop to it below. $GOPATH/bin is deliberately not on PATH:
+# script/bootstrap no longer `go install`s anything (the linter runs
+# from a pinned image, never from a host install), so nothing lands
 # there and adding it would only widen what this image resolves.
+#
+# The module cache is kept outside that home, at the base image's
+# default /go/pkg/mod, and belongs to root: script/bootstrap fills it as
+# root. Do not move it into the home and hand it over with `chown -R`:
+# that walks every file in it, which took from about 80 s to over ten
+# minutes on a shared host, depending on load.
 RUN adduser -D -u 1000 builder
 ENV HOME=/home/builder
 ENV GOPATH=/home/builder/go
+ENV GOMODCACHE=/go/pkg/mod
 ENV GOCACHE=/home/builder/.cache/go-build
 
 WORKDIR /src
@@ -83,11 +90,22 @@ COPY script/ script/
 COPY go.mod go.sum ./
 RUN script/bootstrap
 
-COPY . .
+# Hand builder only what it writes to, without walking the module cache.
+# This layer stays cached with bootstrap.
+# - /src itself: make build writes the binary into it, and git refuses
+#   a repository whose top directory belongs to another user.
+# - the module cache's cache/download directory itself, not what is in
+#   it: Go only reads the downloaded modules, but make build saves its
+#   lookup of this module's own version from git there, in a new
+#   directory named after the module path.
+# - builder's home: the go commands bootstrap ran as root left Go's
+#   telemetry files there, a few small files.
+RUN chown builder:builder /src /go/pkg/mod/cache/download && \
+    chown -R builder:builder /home/builder
 
-# Hand the sources and caches to the unprivileged user, then drop root
-# before running any checks or builds.
-RUN chown -R builder:builder /src /home/builder
+# The sources are handed to builder as they are copied, so no layer has
+# to walk them. Then drop root before running any checks or builds.
+COPY --chown=builder:builder . .
 USER builder
 
 # Fail the build unless the branch is green. Runs as non-root so the

README.md

@@ -51,6 +51,122 @@ daily `sfdupes scan` cron job, with the reporting commands run
 interactively whenever needed; their results are as fresh as the last
 completed scan.
 
+### Install
+
+With Go installed, this builds and installs the current `main` branch:
+
+```sh
+go install sneak.berlin/go/sfdupes@main
+```
+
+The binary goes to `$(go env GOPATH)/bin`, or to `$GOBIN` when that is
+set. A binary installed this way reports its version as `dev`; one
+built from a clone or into the Docker image carries the git tag or
+commit it was built from.
+
+From a clone, `make build` writes the binary to `./sfdupes`:
+
+```sh
+git clone https://git.eeqj.de/sneak/sfdupes.git
+cd sfdupes
+make build
+```
+
+Copy the binary to `/usr/local/bin` for the cron job below.
+
+`make docker` builds the Docker image, tagged `sfdupes`, after running
+the tests and the linter (see "Build"). The image runs `sfdupes` as
+root with the database at its default path, so a bind mount of
+`/var/lib/sfdupes` keeps the database between runs. Mount the scanned
+tree at the same path inside the container as on the host; read-only
+is enough. The database records paths as the container sees them, so
+the reports then name the host's paths.
+
+```sh
+make docker
+docker run --rm -v /srv:/srv:ro -v /var/lib/sfdupes:/var/lib/sfdupes \
+    sfdupes scan /srv
+docker run --rm -v /var/lib/sfdupes:/var/lib/sfdupes sfdupes report > dupes.tsv
+```
+
+### Daily scan from cron
+
+Run `scan` as root, so that it can read every file: a path it cannot
+read is skipped with a warning and loses its database record (see
+"Rules for the walk"). As a file `/etc/cron.d/sfdupes`:
+
+```
+30 3 * * * root /usr/local/bin/sfdupes scan /srv 2>>/var/log/sfdupes.log || tail -n 3 /var/log/sfdupes.log
+```
+
+-   The database is `/var/lib/sfdupes/db.sqlite`, created with its
+    directory by the first scan. To keep it elsewhere, set
+    `SFDUPES_DATABASE=/path/to/db.sqlite` before the command on the same
+    line.
+-   `scan` writes nothing to stdout. Its stderr, appended here to
+    `/var/log/sfdupes.log`, holds a plain progress line as each phase
+    starts and then at most every 5 seconds, a warning for each path it
+    skips, and the summary line (see "Progress" and "`scan` mode"). The
+    log grows with every scan; rotate it like any other.
+-   Skipped paths do not fail a scan: it still exits 0, and cron sends
+    nothing. A scan that fails, or is stopped by `SIGINT` or `SIGTERM`,
+    exits 1 with the reason among the last lines of the log; `tail`
+    prints them, and cron mails them to root if the host can send mail.
+-   A scan still running when the next one starts carries on. The new
+    one fails at once, and the lines cron mails include
+    `sfdupes: another scan is running (lock held on /var/lib/sfdupes/db.sqlite.lock)`.
+-   `report` and `trees` need only read access to the database (see
+    "Database"). Under the usual umask of `022` the first scan creates
+    it readable by every user, so an unprivileged user can run them
+    against root's database.
+
+### Reading the reports
+
+Each row of `report` names two copies of one file, and each row of
+`trees` two copies of one directory tree (see "Report output format"
+and "Trees output format"). In a group of copies, the path that sorts
+first byte by byte is `first` and every other path is a `dupe` of it.
+`first` says nothing about which copy is the original or the oldest;
+which copy to keep is your choice.
+
+A row is a candidate, not proof:
+
+-   The reports read only the database, so they show the files as of
+    the last scan; a file may have changed or gone since.
+-   A file of 50 MiB or more is compared only on samples of its content
+    (see "Duplicate detection").
+-   Paths that are hard links to one file are listed as duplicates, but
+    they share their data, so removing one frees nothing.
+
+Compare a pair byte for byte before removing either copy. For the row
+`/srv/a/big.iso`, `/srv/b/big-copy.iso`, `4294967296`:
+
+```sh
+cmp /srv/a/big.iso /srv/b/big-copy.iso && echo identical
+[ /srv/a/big.iso -ef /srv/b/big-copy.iso ] && echo "hard links"
+```
+
+`cmp` prints nothing and exits 0 only when every byte matches, and
+otherwise reports where the files differ. The second line prints
+`hard links` when the two paths are the same file, so removing either
+frees nothing.
+
+A path holding a backslash, tab, newline or carriage return is escaped
+in the reports (see "Report output format"). Undo the escapes before
+using it. `printf '%b'` does exactly that, because every backslash in
+an escaped path starts one of the four escapes. Command substitution
+drops trailing newlines, so print an `x` after the path and remove it
+afterwards, or a path that ends in a newline names a different file:
+
+```sh
+p="$(printf '%bx' '/srv/a/tab\tname.txt')"; p="${p%x}"
+cmp "$p" /srv/b/tab-copy.txt
+```
+
+Check a `trees` row with `diff -r`, which compares the two trees file
+by file and also names anything present in only one of them, such as
+an empty directory or a symlink, which `trees` does not see.
+
 ## Rationale
 
 Duplicate finders that hash entire files do not scale to the target
@@ -95,13 +211,14 @@ Goals, in order:
     (ZFS pool under resilver). Holding one small record (path, size,
     mtime) per file in memory during a scan is acceptable; holding
     every file's hashes is not (they stay in the database). The
-    reporting commands hold no file's hashes either: `report` lets
-    SQLite group and order the records and writes each row as it reads
-    it, so its memory does not grow with the database, and `trees`
-    reads the records in path order and keeps each directory's path,
-    digest and totals, plus the files of the directories holding the
-    record being read, so its memory grows with the number of
-    directories, not files.
+    reporting commands do not hold every file's hashes either: `report`
+    lets SQLite group and order the records and writes each row as it
+    reads it, so its memory does not grow with the database, and
+    `trees` reads the records in path order and keeps each directory's
+    path, digest and totals, plus the hashes of only the files in the
+    directories holding the record being read, so its memory grows with
+    the number of directories and with the size of the largest
+    directory.
 3.  **Scan incrementally, analyze offline.** The expensive filesystem
     scan maintains a persistent database; an unchanged file is never
     read again on a rescan, except to compute its content hash once a
@@ -111,8 +228,8 @@ Goals, in order:
     again. `scan` is designed to be cronned; the reports run at any
     time against the last completed scan.
 4.  **Clean stream separation.** Everything on stdout is machine-readable
-    data. All progress, warnings, and summaries go to stderr. Never mix
-    them.
+    data. All progress, warnings, summaries, and help and usage text go
+    to stderr. Never mix them.
 
 ### Constraints
 
@@ -120,7 +237,8 @@ Goals, in order:
     `sfdupes`.
 -   Dependencies: standard library, `github.com/spf13/cobra` for the
     CLI, **one progress-bar library**
-    (`github.com/schollz/progressbar/v3`), **one SQLite driver**
+    (`github.com/schollz/progressbar/v3`), `golang.org/x/term` to tell
+    whether stderr is a terminal, **one SQLite driver**
     (`modernc.org/sqlite`, pure Go, so builds keep cgo disabled), and
     `golang.org/x/sys` for `flock(2)` (the scan lock, see "Database").
     `github.com/spf13/viper` is permitted if configuration-file support
@@ -147,8 +265,18 @@ Three subcommands, all implemented:
 sfdupes scan [--workers N] [-x] PATH...
 sfdupes report > dupes.tsv
 sfdupes trees > dupetrees.tsv
+sfdupes --version
+sfdupes [command] --help
 ```
 
+`--workers N` sets the size of each `scan` worker pool (default: the
+number of CPUs), and `-x` (`--one-file-system`) keeps the walk of each
+operand on that operand's filesystem; both are described under
+"`scan` mode". `sfdupes --version` (or `-v`) prints one line,
+`sfdupes VERSION`, to stdout and exits 0, writing nothing to stderr.
+`-h` or `--help`, alone or after a subcommand, prints the help text to
+stderr and exits 0, writing nothing to stdout.
+
 ### Database
 
 All three subcommands operate on a single SQLite database file:
@@ -182,22 +310,31 @@ All three subcommands operate on a single SQLite database file:
     (keeping the WAL small and letting concurrent reports observe
     progress), so a report may see a scan's changes partially applied,
     and a scan that dies partway leaves a valid database holding
-    everything hashed so far; the next scan skips those records and
-    converges toward the filesystem.
+    every batch committed so far (an interrupted scan also commits the
+    batch in progress, see "Error handling and exit codes"); the next
+    scan skips those records and converges toward the filesystem.
 -   `scan` switches the database back to rollback-journal mode when it
     closes it, so between scans the database file alone holds the whole
     database. Each switch needs the database to itself: a `scan` that
     starts while a report is still reading waits for it up to the
     10-second busy timeout, then fails; a `scan` that ends while a
     report has the database open warns and leaves the database in WAL
-    mode until the next scan.
+    mode until the next scan. `report` writes each row as it reads it,
+    so it is still reading while its output is paused (a pager, a
+    stalled pipe), and a `scan` started then fails after the busy
+    timeout.
 -   `report` and `trees` open the database read-only and need only read
     access to the database file, and no write access to its directory.
     While the database is in WAL mode they also read the `-wal` and
     `-shm` files beside it, which SQLite creates with the database
     file's permissions.
 -   Schema (`PRAGMA user_version` is the schema version, currently 1; a
-    database with any other version is a fatal error):
+    database with any other version is a fatal error. `scan` creates
+    the schema and sets the version in one transaction, so a first scan
+    stopped while doing so leaves an empty database the next scan sets
+    up. A database at version 0 that already has a `files` table was
+    therefore not made by sfdupes; every subcommand refuses it with an
+    error telling the user to remove the file and rescan):
 
     ```sql
     CREATE TABLE files (
@@ -429,7 +566,9 @@ Rules for the walk:
 Concurrency: the walk phase (which also stats files), the hash phase,
 and the content phase each use a worker pool of `--workers` workers
 (default `runtime.NumCPU()`); the walk parallelizes across
-directories, hashing across files. All three phases are seek-bound on
+directories, hashing across files. `--workers` must be at least 1: a
+smaller value is a usage error, reported in one line on stderr with
+exit 2 before anything is scanned. All three phases are seek-bound on
 spinning disks, so raising `--workers` well past the core count can
 help on pools with many spindles. The main goroutine owns
 partitioning, database writes, and progress rendering; progress
@@ -601,10 +740,18 @@ hash: [12345/98765] 12% |████      | 92 files/s elapsed 2:32 eta 17:54
 
 Additional requirements:
 
--   When stderr is not a TTY, do not emit ANSI redraws: print a plain
-    one-line progress update no more often than every 5 seconds instead.
+-   When stderr is not a terminal (a pipe, a file, `/dev/null`), do not
+    emit ANSI redraws: print a plain one-line progress update the moment
+    each phase starts, then no more often than every 5 seconds.
 -   Progress updates are driven from the main goroutine and must be
-    non-blocking with respect to the worker pool.
+    non-blocking with respect to the worker pool. On a terminal the
+    spinner-style displays also redraw on their own several times a
+    second, so their count and elapsed time stay current while a phase
+    waits for its next item.
+-   A warning printed during a phase always lands on a line of its own,
+    never inside the progress display.
+-   A bar whose phase stops short of its total, as an interrupted one
+    does, is left as last drawn rather than filled up.
 -   `report` and `trees` modes need no progress display, only their
     stderr summaries.
 
@@ -614,9 +761,11 @@ Additional requirements:
 -   `1`: fatal error (e.g., a `PATH` operand does not exist, another
     `scan` is already running against the same database, the database
     cannot be created/opened/read/written, a missing database for
-    `report`/`trees`, stdout write failure).
--   `2`: usage error (including `scan` with no `PATH` operand and
-    `report`/`trees` with any positional argument).
+    `report`/`trees`, stdout write failure), or a `scan` stopped by
+    `SIGINT` or `SIGTERM` (see below).
+-   `2`: usage error (including `scan` with no `PATH` operand, `scan`
+    with `--workers` below 1, and `report`/`trees` with any positional
+    argument).
 
 A stdout write failure, such as a full disk, is reported in one line on
 stderr and exits 1. Two cases never reach sfdupes as a failed write:
@@ -630,6 +779,24 @@ stderr and exits 1. Two cases never reach sfdupes as a failed write:
     the output is discarded and the run succeeds, as with
     `> /dev/null`.
 
+`scan` stops cleanly on `SIGINT` (Ctrl-C) or `SIGTERM`. Its workers
+stop taking work, each finishing at most the directory listing or file
+it is reading; the progress display is finished; and the records it has
+hashed but not yet committed are committed, so the next scan does not
+hash them again. Apart from that commit it starts no further writes or
+deletions: records are deleted only after a complete walk, so those
+under paths an interrupted walk never reached are kept. The database is
+closed and the lock released as on any other exit, the line
+`scan: interrupted after N files` goes to stderr, N being the number of
+files the walk reached, and the exit code is 1. The next scan skips the
+records already written and converges as usual.
+
+After the first signal `scan` stops catching them, so a second one ends
+it at once, as an uncaught signal does: the records not yet committed
+are lost, and the database is left valid, as when any scan dies (see
+"Database"). A `SIGINT` that `scan` inherits as ignored, as a script's
+background job does, stays ignored.
+
 ## Entrypoints
 
 This repository adheres to the

TODO.md

@@ -29,10 +29,50 @@
 
 # Completed Steps
 
+- `scan` rejects `--workers` below 1 as a usage error instead of
+  running single-threaded (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/10)
+
+- a test fails when either walk cancellation check in `scan.go` is
+  removed (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/81)
+
+- test that `scan` refuses a database with another schema version
+  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/64)
+
+- correct four inaccurate comments in `cancel_test.go` and rename
+  `walkCancelInFlightDirs` to `walkCancelInFlightFiles` (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/33)
+
+- test the `-x` filesystem-boundary rules in `subdirJob` (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/17)
+
+- `scan` creates the schema in one transaction; a version-0 database with a
+  `files` table is refused with a clear schema-version error (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/11)
+
+- README documents install, Docker, a daily cron scan and how to read
+  and check the reports (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/54)
+
+- the `Dockerfile` build stage keeps the Go module cache out of `builder`'s
+  home and copies the sources with `--chown`, so no `chown -R` walks them
+  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/43)
+
+- `--version` prints `sfdupes VERSION` to stdout; README documents it and
+  `--help` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/15)
+
+- `scan` stops cleanly on `SIGINT` or `SIGTERM`: commits what it has
+  hashed, deletes nothing more, exits 1 (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/5)
+
 - `report` and `trees` stream the records instead of holding them all in
   memory; the schema gains the `files_signature` index (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/14)
 
+- progress prints at once on a non-terminal, uses a real terminal test,
+  and prints warnings through a spinner instead of racing its redraw
+  (2026-10-03, https://git.eeqj.de/sneak/sfdupes/issues/13)
+
 - warn about and skip symlink, socket, FIFO, device and `.zfs`
   operands, keeping the records beneath them (2026-10-03,
   https://git.eeqj.de/sneak/sfdupes/issues/9)

cancel_test.go

@@ -4,20 +4,35 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"fmt"
 	"os"
+	"os/signal"
 	"path/filepath"
+	"slices"
 	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"testing"
 	"time"
 )
 
-// poolUnwind bounds how long a goroutine is given to leave a pool
-// after its context is cancelled. Only a failing run ever waits this
-// long: a pool that ignored its cancellation parks forever, and this
-// is what turns that into a failed assertion instead of a suite that
-// hangs until the test binary's own timeout.
+// This file gathers the tests for scan cancellation and worker-pool
+// unwinding. Everything it exercises lives in scan.go, so by the repo's
+// convention of one test file per source file it would belong in
+// scan_test.go. It is kept separate on purpose: cancellation behaviour
+// cuts across both the walk pool and the hash pool as a single concern,
+// and scan_test.go is already over 1,600 lines. That is the deliberate
+// exception the convention otherwise expects to be stated.
+
+// poolUnwind bounds how long a test waits for a cancellation to take
+// effect: for a goroutine to return or a channel to close once its
+// context is cancelled, or for a signal to cancel the scan's context.
+// Only a failing run waits this long, and the bound is what makes that
+// failure an assertion instead of a hang. A call made without it, as
+// most of this file's scans are, has no bound: a regression that parks
+// it is caught only as the test binary's own timeout.
 const poolUnwind = 2 * time.Second
 
 // walkClock is a context whose cancellation is driven by the scan's
@@ -28,9 +43,14 @@ const poolUnwind = 2 * time.Second
 //
 // The accounting behind the n chosen by each test: every blocking
 // channel operation in the walk selects on Done, so the walk spends
-// one consultation per file event plus a couple per directory, while
-// the index load that runs ahead of it spends a small fixed number
-// (three) whatever the record count.
+// one consultation per file event plus a couple per directory. The
+// index load that runs ahead of it also consults Done, but a bounded
+// number of times that does not grow with the record count. The tests
+// depend on that property, not on the bound's exact value: each test
+// sets n from the consultations of the walk, plus those of the hash
+// phase when it cancels mid-hash, far from both ends of the phase it
+// interrupts, so the cancellation lands inside that phase whatever the
+// record count.
 type walkClock struct {
 	n    int64
 	seen atomic.Int64
@@ -86,11 +106,14 @@ func (c *walkClock) Value(_ any) any {
 // directory still queued and only the handful already in flight can
 // emit anything more.
 const (
-	walkCancelDirs         = 100
-	walkCancelFilesPerDir  = 20
-	walkCancelFiles        = walkCancelDirs * walkCancelFilesPerDir
-	walkCancelWorkers      = 4
-	walkCancelInFlightDirs = walkCancelWorkers * walkCancelFilesPerDir
+	walkCancelDirs        = 100
+	walkCancelFilesPerDir = 20
+	walkCancelFiles       = walkCancelDirs * walkCancelFilesPerDir
+	walkCancelWorkers     = 4
+	// The most files the walkCancelWorkers directories already in
+	// flight when the scan is cancelled can still emit, at
+	// walkCancelFilesPerDir each. A file count, not a directory count.
+	walkCancelInFlightFiles = walkCancelWorkers * walkCancelFilesPerDir
 )
 
 // walkCancelAtDone is the consultation on which the fixture's context
@@ -150,9 +173,13 @@ func assertRecordsIntact(t *testing.T, db *sql.DB, before []string) {
 // Every one of those records would look vanished to the update phase.
 // The guard is what stops the scan there, and this test is what
 // notices if it stops doing so: deleting the guard, or making it
-// unreachable, makes the scan carry its truncated view into a later
-// phase and fail there instead, with a wrapped error rather than the
-// bare cancellation.
+// unreachable, makes the scan carry its truncated view into the update
+// phase, which counts every record the walk never reached for removal.
+//
+// The syncScan call here is not bounded by poolUnwind: a regression
+// that left a worker pool parked would hang it, and that regression is
+// caught only by the test binary's own timeout, not by a quick
+// assertion.
 //
 //nolint:paralleltest // counts goroutines: must not run beside others
 func TestSyncScanCancelledMidWalkKeepsRecords(t *testing.T) {
@@ -182,10 +209,10 @@ func TestSyncScanCancelledMidWalkKeepsRecords(t *testing.T) {
 
 // assertWalkGuardAborted checks that the scan stopped at the post-walk
 // guard: with a census that is neither empty (the walk really ran)
-// nor complete (it really was cut short), and with the guard's own
-// bare cancellation as the error. A wrapped error means the partial
-// census was carried past the guard into the hash or update phase,
-// which is the failure this test exists to catch.
+// nor complete (it really was cut short), and with no record counted
+// for removal. A removal count means the partial census was carried
+// past the guard into the update phase, which is the failure this test
+// exists to catch.
 func assertWalkGuardAborted(t *testing.T, st scanStats, err error) {
 	t.Helper()
 
@@ -194,12 +221,6 @@ func assertWalkGuardAborted(t *testing.T, st scanStats, err error) {
 			err, context.Canceled)
 	}
 
-	if errors.Unwrap(err) != nil {
-		t.Errorf("syncScan reported %q, want the guard's bare "+
-			"cancellation: a wrapped error means the truncated census "+
-			"reached a later phase", err)
-	}
-
 	if st.unchanged == 0 {
 		t.Fatalf("stats = %+v: the census is empty, so the walk never "+
 			"ran and the guard was reached for the wrong reason", st)
@@ -211,10 +232,11 @@ func assertWalkGuardAborted(t *testing.T, st scanStats, err error) {
 	}
 
 	// The workers drop every directory still queued once the scan is
-	// cancelled, so only the directories already in flight can add to
-	// the census after the fact. A census beyond that bound would mean
-	// the cancellation was not observed where it should have been.
-	limit := walkCancelAtDone + walkCancelInFlightDirs
+	// cancelled, so only the files in the directories already in flight
+	// can add to the census after the fact. A census beyond that bound
+	// would mean the cancellation was not observed where it should have
+	// been.
+	limit := walkCancelAtDone + walkCancelInFlightFiles
 	if st.unchanged > limit {
 		t.Errorf("census covers %d files, want at most %d: the walk kept "+
 			"taking directories off the queue after cancellation",
@@ -260,6 +282,242 @@ func TestSyncScanCancelledBeforeLoadIndex(t *testing.T) {
 	assertRecordsIntact(t, db, before)
 }
 
+// hashCancelAtDone is the consultation on which the mid-hash test's
+// context cancels itself. The walk of buildWalkCancelTree spends about
+// one per file and three per directory, and the hash phase then one per
+// file hashed, so this lands about half way through the hash phase.
+const hashCancelAtDone = walkCancelFiles + 3*walkCancelDirs +
+	walkCancelFiles/2
+
+// TestSyncScanCancelledMidHashKeepsHashedRecords cancels a first scan
+// part-way through its hash phase. The fixture holds fewer files than a
+// batch, so every file hashed is still waiting to be committed: the scan
+// must commit them all before it returns, and the next scan must hash
+// only the rest.
+func TestSyncScanCancelledMidHashKeepsHashedRecords(t *testing.T) {
+	t.Parallel()
+
+	dir := buildWalkCancelTree(t)
+	db := openTestDB(t)
+
+	st, err := syncScan(newWalkClock(hashCancelAtDone), db,
+		[]string{dir}, walkCancelWorkers, false)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("syncScan cancelled mid-hash = %v, want %v",
+			err, context.Canceled)
+	}
+
+	if st.walked != walkCancelFiles || st.added == 0 ||
+		st.added >= walkCancelFiles {
+		t.Fatalf("stats = %+v: want the walk complete and the hash phase "+
+			"cut short", st)
+	}
+
+	if got := len(dbRecords(t, db)); got != st.added {
+		t.Errorf("%d records after the cancelled scan, want the %d it hashed",
+			got, st.added)
+	}
+
+	hashed := st.added
+
+	st = syncTree(t, db, dir)
+	if st.added != walkCancelFiles-hashed || st.unchanged != hashed {
+		t.Errorf("next scan stats = %+v, want %d added %d unchanged",
+			st, walkCancelFiles-hashed, hashed)
+	}
+}
+
+// storedPaths opens the database at path as report does, which fails
+// unless it is a valid database, and returns its records' paths.
+func storedPaths(t *testing.T, path string) []string {
+	t.Helper()
+
+	db, err := openReportDatabase(t.Context(), path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = db.Close() }()
+
+	return recordPaths(dbRecords(t, db))
+}
+
+// TestRunScanInterrupted calls the scan entrypoint with a context that
+// is already cancelled, as when a signal arrives at once. It must return
+// errInterrupted promptly with its one line on stderr, leave the
+// database valid and as it was, and leave nothing in the way of the
+// next scan, which must bring the database up to date.
+func TestRunScanInterrupted(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	stderr := captureStderr(t)
+	dir := buildSmokeTree(t)
+
+	err := runScan(t.Context(), []string{dir}, walkCancelWorkers, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	before := storedPaths(t, path)
+
+	// A vanished file and a new one: the interrupted scan records
+	// neither.
+	gone := filepath.Join(dir, "a", "unique.bin")
+
+	err = os.Remove(gone)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	added := writeFile(t, dir, "a/new.bin", pattern(50, 10))
+	shown := len(stderr())
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+
+		err = runScan(cancelledContext(t), []string{dir}, walkCancelWorkers,
+			false)
+	}()
+
+	awaitReturn(t, done, "runScan")
+
+	if !errors.Is(err, errInterrupted) {
+		t.Fatalf("runScan on a cancelled context = %v, want %v",
+			err, errInterrupted)
+	}
+
+	want := "scan: interrupted after 0 files\n"
+	if got := stderr()[shown:]; got != want {
+		t.Errorf("stderr = %q, want %q", got, want)
+	}
+
+	assertNoSidecars(t, path)
+
+	if got := storedPaths(t, path); !slices.Equal(got, before) {
+		t.Errorf("records = %q after the interrupted scan, want %q",
+			got, before)
+	}
+
+	err = runScan(t.Context(), []string{dir}, walkCancelWorkers, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := storedPaths(t, path)
+	if slices.Contains(got, gone) || !slices.Contains(got, added) {
+		t.Errorf("records = %q after the next scan, want %q gone and %q "+
+			"added", got, gone, added)
+	}
+}
+
+// TestRunScanInterruptedMidHash interrupts the scan entrypoint part-way
+// through its hash phase, after the database is open. It must return
+// errInterrupted, release the lock, end stderr with its line counting
+// every file the walk reached, close the database out of WAL mode, and
+// keep the records it hashed.
+func TestRunScanInterruptedMidHash(t *testing.T) {
+	path := testDBPath(t)
+	t.Setenv(databaseEnv, path)
+
+	stderr := captureStderr(t)
+	dir := buildWalkCancelTree(t)
+
+	err := runScan(newWalkClock(hashCancelAtDone), []string{dir},
+		walkCancelWorkers, false)
+	if !errors.Is(err, errInterrupted) {
+		t.Fatalf("runScan interrupted mid-hash = %v, want %v",
+			err, errInterrupted)
+	}
+
+	holdScanLock(t, path)
+
+	want := fmt.Sprintf("scan: interrupted after %d files\n", walkCancelFiles)
+	if got := stderr(); !strings.HasSuffix(got, want) {
+		t.Errorf("stderr = %q, want it to end with %q", got, want)
+	}
+
+	assertNoSidecars(t, path)
+
+	db, err := openReportDatabase(t.Context(), path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = db.Close() }()
+
+	// A plain close also removes the sidecars, but leaves WAL mode on.
+	var mode string
+
+	err = db.QueryRowContext(t.Context(), "PRAGMA journal_mode").Scan(&mode)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if mode != "delete" {
+		t.Errorf("journal mode = %q after the interrupted scan, want %q",
+			mode, "delete")
+	}
+
+	kept := len(dbRecords(t, db))
+	if kept == 0 || kept >= walkCancelFiles {
+		t.Errorf("%d records after the interrupted scan, want those it "+
+			"hashed: some but not all of the %d files", kept, walkCancelFiles)
+	}
+}
+
+// TestInterruptContextCatchesSIGTERM sends SIGTERM to the test process
+// while the scan's handler is installed, and checks that it cancels the
+// scan's context.
+//
+//nolint:paralleltest // signals the whole process: must not run beside a scan
+func TestInterruptContextCatchesSIGTERM(t *testing.T) {
+	// Caught here as well, so that a handler that misses SIGTERM fails
+	// this test instead of ending the test process.
+	caught := make(chan os.Signal, 1)
+	signal.Notify(caught, syscall.SIGTERM)
+
+	defer signal.Stop(caught)
+
+	ctx, stop := interruptContext(t.Context())
+	defer stop()
+
+	err := syscall.Kill(os.Getpid(), syscall.SIGTERM)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case <-ctx.Done():
+	case <-time.After(poolUnwind):
+		t.Fatal("SIGTERM did not cancel the scan's context")
+	}
+}
+
+// TestCommitFullBatchKeepsFailedBatch checks that a full batch whose
+// commit fails, as it does once the scan is interrupted, stays in the
+// batch, so that syncScan's final commit saves it.
+func TestCommitFullBatchKeepsFailedBatch(t *testing.T) {
+	t.Parallel()
+
+	s := &scanState{db: openTestDB(t)}
+	for i := range updateBatchSize {
+		s.batch = append(s.batch, scanRec{path: "/f" + strconv.Itoa(i)})
+	}
+
+	err := s.commitFullBatch(cancelledContext(t))
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("commitFullBatch on a cancelled context = %v, want %v",
+			err, context.Canceled)
+	}
+
+	if len(s.batch) != updateBatchSize {
+		t.Errorf("batch holds %d records after the failed commit, want %d",
+			len(s.batch), updateBatchSize)
+	}
+}
+
 // drainClosed counts the values received from ch until it closes,
 // failing the test if it does not close within poolUnwind. A pool that
 // ignored its cancellation leaves its channel open with its goroutines
@@ -328,20 +586,49 @@ func TestSendEventAbandonsBlockedSend(t *testing.T) {
 	awaitReturn(t, done, "sendEvent")
 }
 
-// TestWalkWorkersDropQueuedDirs checks that cancelled walk workers keep
-// reading jobs and drop the directories rather than stopping their
-// read: the range over jobs has to run out for the pool to tear down
-// and close its event stream.
-func TestWalkWorkersDropQueuedDirs(t *testing.T) {
+// TestWalkOneDirStopsWhenCancelled checks that a cancelled scan stops
+// reading a directory instead of going through the rest of its
+// entries. A walk that kept going would return the subdirectory below
+// to descend into. Unlike a file event, that return is not a send the
+// cancellation can abandon, so the test catches the regression every
+// time.
+func TestWalkOneDirStopsWhenCancelled(t *testing.T) {
 	t.Parallel()
 
 	dir := t.TempDir()
-	writeEmptyFiles(t, dir, walkCancelFilesPerDir)
+
+	err := os.Mkdir(filepath.Join(dir, "sub"), 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Unbuffered and unread: on a cancelled scan every send gives up.
+	events := make(chan walkEvent)
+
+	subs := walkOneDir(cancelledContext(t), dirJob{path: dir}, false, events)
+	if len(subs) != 0 {
+		t.Errorf("cancelled walkOneDir returned %+v to descend into, "+
+			"want none", subs)
+	}
+}
+
+// TestWalkWorkersDropQueuedDirs checks that cancelled walk workers keep
+// reading jobs and drop the directories rather than stopping their
+// read: the range over jobs has to run out for the pool to tear down
+// and close its event stream. The queued directory does not exist, so
+// a worker that walked it anyway would send a warning before
+// walkOneDir's own cancellation check could stop it. On a cancelled
+// scan that send delivers or gives up at random, so with 64 jobs
+// queued the regression has a one in 2^64 chance of passing.
+func TestWalkWorkersDropQueuedDirs(t *testing.T) {
+	t.Parallel()
+
+	missing := filepath.Join(t.TempDir(), "missing")
 
 	jobs, _, events := startWalkWorkers(cancelledContext(t), 2, false)
 
-	for range 4 {
-		jobs <- dirJob{path: dir}
+	for range 64 {
+		jobs <- dirJob{path: missing}
 	}
 
 	close(jobs)
@@ -412,7 +699,11 @@ func TestDispatchDirsClosesJobsWhenCancelled(t *testing.T) {
 
 // TestFeedHashJobsClosesJobsWhenCancelled checks that the hash feeder
 // abandons the runs it has not queued yet and still closes the job
-// channel, which is what lets the workers' range terminate.
+// channel, which is what lets the workers' range terminate. The
+// receive on jobs below is not bounded: a feeder that returned without
+// closing jobs would leave that receive with no sender and no close, so
+// this regression is caught by the test binary's timeout rather than by
+// a bounded assertion.
 func TestFeedHashJobsClosesJobsWhenCancelled(t *testing.T) {
 	t.Parallel()
 
@@ -440,6 +731,16 @@ func TestFeedHashJobsClosesJobsWhenCancelled(t *testing.T) {
 // nobody wants the hashes of — while still letting the range run out
 // so the pool tears down. The queued run names a file that does not
 // exist, so a worker that hashed it anyway would produce a result.
+//
+// hashWorker's other cancellation exit, abandoning the send of a
+// result, is reachable from the scan: stop cancels the pool before it
+// drains results, so a worker waiting on that send can leave through
+// it. The tests that stop a scan mid-hash, among them
+// TestScanHashWriteFailureUnwindsPool, reach it in some runs only,
+// depending on timing, and no test fails without it, since stop's
+// drain frees a waiting worker anyway. This test, for its part, catches
+// a removed drop check in some runs only: a worker that hashes the run
+// anyway then picks at random between sending the result and leaving.
 func TestHashWorkerDropsQueuedRuns(t *testing.T) {
 	t.Parallel()
 
@@ -472,7 +773,10 @@ func TestHashWorkerDropsQueuedRuns(t *testing.T) {
 // TestHashPhaseCancelledReturnsContextError checks the result loop's
 // own exit: with the pool cancelled, no result will ever arrive, and
 // the loop must leave through the cancellation rather than wait for a
-// receive that cannot happen.
+// receive that cannot happen. This call is not bounded by poolUnwind: a
+// loop that dropped its cancellation case would block on that receive,
+// so the regression surfaces as the test binary's timeout rather than
+// as a bounded assertion.
 func TestHashPhaseCancelledReturnsContextError(t *testing.T) {
 	t.Parallel()
 

db.go

@@ -219,6 +219,12 @@ func openReportDatabase(ctx context.Context,
 	}
 
 	v, err := userVersion(ctx, db)
+	if err == nil && v == 0 {
+		// An empty database passes this check and fails the version
+		// check below.
+		err = checkUnversioned(ctx, db)
+	}
+
 	if err != nil {
 		_ = db.Close()
 
@@ -245,6 +251,11 @@ func initSchema(ctx context.Context, db *sql.DB) error {
 
 	switch v {
 	case 0:
+		err = checkUnversioned(ctx, db)
+		if err != nil {
+			return err
+		}
+
 		return createSchema(ctx, db)
 	case schemaVersion:
 		return nil
@@ -254,25 +265,65 @@ func initSchema(ctx context.Context, db *sql.DB) error {
 	}
 }
 
+// checkUnversioned checks a database at user_version 0 before it is
+// taken for an empty one. createSchema creates the files table and
+// sets the version together, so a files table at version 0 was made by
+// something else. Adopting it could corrupt unrelated data, so that is
+// a schema-version error telling the operator to remove the file and
+// rescan.
+func checkUnversioned(ctx context.Context, db *sql.DB) error {
+	var name string
+
+	err := db.QueryRowContext(ctx,
+		"SELECT name FROM sqlite_master "+
+			"WHERE type = 'table' AND name = 'files'").Scan(&name)
+
+	switch {
+	case err == nil:
+		return fmt.Errorf(
+			"has a files table but no schema version; "+
+				"remove the file and rescan: %w", errSchemaVersion)
+	case errors.Is(err, sql.ErrNoRows):
+		return nil
+	default:
+		return fmt.Errorf("check for files table: %w", err)
+	}
+}
+
 // createSchema applies the schema to a fresh database and stamps the
-// schema version.
+// schema version in one transaction, so a creation stopped partway, by
+// an interrupt or an error, leaves an empty database the next scan
+// sets up, never a files table at version 0, which checkUnversioned
+// refuses.
 func createSchema(ctx context.Context, db *sql.DB) error {
-	_, err := db.ExecContext(ctx, createTableSQL)
+	tx, err := db.BeginTx(ctx, nil)
 	if err != nil {
 		return fmt.Errorf("create schema: %w", err)
 	}
 
-	_, err = db.ExecContext(ctx, createIndexSQL)
+	defer func() { _ = tx.Rollback() }()
+
+	_, err = tx.ExecContext(ctx, createTableSQL)
 	if err != nil {
 		return fmt.Errorf("create schema: %w", err)
 	}
 
-	_, err = db.ExecContext(ctx,
+	_, err = tx.ExecContext(ctx, createIndexSQL)
+	if err != nil {
+		return fmt.Errorf("create schema: %w", err)
+	}
+
+	_, err = tx.ExecContext(ctx,
 		"PRAGMA user_version = "+strconv.Itoa(schemaVersion))
 	if err != nil {
 		return fmt.Errorf("set schema version: %w", err)
 	}
 
+	err = tx.Commit()
+	if err != nil {
+		return fmt.Errorf("create schema: %w", err)
+	}
+
 	return nil
 }
 

db_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 	"testing"
 )
 
@@ -77,6 +78,76 @@ func TestOpenScanDatabaseCreates(t *testing.T) {
 	}
 }
 
+func TestOpenDatabaseUnversionedForeign(t *testing.T) {
+	t.Parallel()
+
+	// A database that has a files table but user_version 0, written by
+	// some other tool. report, trees and scan must refuse it with the
+	// schema-version error, not adopt it and not emit a raw SQLite
+	// "table files already exists".
+	path := testDBPath(t)
+
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = db.ExecContext(t.Context(), "CREATE TABLE files (x INTEGER)")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_ = db.Close()
+
+	_, err = openReportDatabase(t.Context(), path)
+	if !errors.Is(err, errSchemaVersion) ||
+		!strings.Contains(err.Error(), "remove the file and rescan") {
+		t.Fatalf("report: err = %v, want errSchemaVersion telling the "+
+			"operator to remove the file and rescan", err)
+	}
+
+	_, err = openScanDatabase(t.Context(), path)
+	if !errors.Is(err, errSchemaVersion) ||
+		!strings.Contains(err.Error(), "remove the file and rescan") {
+		t.Fatalf("scan: err = %v, want errSchemaVersion telling the "+
+			"operator to remove the file and rescan", err)
+	}
+}
+
+func TestSchemaCreationStoppedPartway(t *testing.T) {
+	t.Parallel()
+
+	// A first scan stopped while creating the schema must leave a
+	// database the next scan accepts. max_page_count(2) leaves room for
+	// the files table but not its index, so schema creation fails right
+	// after CREATE TABLE, a point an interrupt could also stop it at.
+	path := testDBPath(t)
+
+	db, err := openDB(path, scanParams+"&_pragma=max_page_count(2)")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = initSchema(t.Context(), db)
+	_ = db.Close()
+
+	if err == nil {
+		t.Fatal("initSchema with no room for the index succeeded")
+	}
+
+	db, err = openScanDatabase(t.Context(), path)
+	if err != nil {
+		t.Fatalf("next scan: %v", err)
+	}
+
+	defer func() { _ = db.Close() }()
+
+	v, err := userVersion(t.Context(), db)
+	if err != nil || v != schemaVersion {
+		t.Fatalf("userVersion = %d, %v; want %d, nil", v, err, schemaVersion)
+	}
+}
+
 func TestOpenReportDatabaseMissing(t *testing.T) {
 	t.Parallel()
 
@@ -86,9 +157,11 @@ func TestOpenReportDatabaseMissing(t *testing.T) {
 	}
 }
 
-func TestOpenReportDatabaseVersionMismatch(t *testing.T) {
+func TestOpenDatabaseVersionMismatch(t *testing.T) {
 	t.Parallel()
 
+	// A database stamped with a schema version other than 0 and
+	// schemaVersion. report, trees and scan must all refuse it.
 	path := testDBPath(t)
 
 	db, err := openScanDatabase(t.Context(), path)
@@ -105,7 +178,12 @@ func TestOpenReportDatabaseVersionMismatch(t *testing.T) {
 
 	_, err = openReportDatabase(t.Context(), path)
 	if !errors.Is(err, errSchemaVersion) {
-		t.Fatalf("err = %v, want errSchemaVersion", err)
+		t.Fatalf("report: err = %v, want errSchemaVersion", err)
+	}
+
+	_, err = openScanDatabase(t.Context(), path)
+	if !errors.Is(err, errSchemaVersion) {
+		t.Fatalf("scan: err = %v, want errSchemaVersion", err)
 	}
 }
 

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/schollz/progressbar/v3 v3.19.1
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/sys v0.46.0
+	golang.org/x/term v0.44.0
 	modernc.org/sqlite v1.54.0
 )
 
@@ -19,7 +20,6 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/term v0.44.0 // indirect
 	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

main.go

@@ -15,6 +15,7 @@
 //	sfdupes scan [--workers N] [-x] PATH...
 //	sfdupes report > dupes.tsv
 //	sfdupes trees > dupetrees.tsv
+//	sfdupes --version
 //
 // See README.md for the complete specification.
 package main
@@ -50,6 +51,10 @@ const (
 // cobra prints for it is the whole message.
 var errNoSubcommand = errors.New("no subcommand")
 
+// errWorkersBelowOne is the usage error for a scan --workers value
+// below 1.
+var errWorkersBelowOne = errors.New("--workers must be at least 1")
+
 // Version is the build version, injected at link time via -ldflags
 // (see the Makefile); "dev" for a plain go build.
 //
@@ -87,6 +92,9 @@ func run(args []string, stdout, stderr io.Writer) int {
 	switch {
 	case err == nil:
 		return exitOK
+	case errors.Is(err, errInterrupted):
+		// The interrupted scan has printed its own line.
+		return exitFatal
 	case errors.As(err, &fatal):
 		// The command ran and failed: a runtime error, reported
 		// without the usage text that a usage error gets.
@@ -94,22 +102,35 @@ func run(args []string, stdout, stderr io.Writer) int {
 
 		return exitFatal
 	default:
-		// A usage error: cobra has already printed the message and
-		// the usage text.
+		// A usage error, which cobra has already reported on stderr.
 		return exitUsage
 	}
 }
 
 // newRootCommand builds the command tree. Everything on stdout is
-// machine-readable data; all human-facing output (help, usage, errors)
-// goes to stderr.
+// machine-readable data, the version line included; all human-facing
+// output (help, usage, errors) goes to stderr.
 func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
+	var showVersion bool
+
+	printVersion := runE(func(context.Context, []string) error {
+		_, err := fmt.Fprintf(stdout, "sfdupes %s\n", Version)
+		if err != nil {
+			return fmt.Errorf("write stdout: %w", err)
+		}
+
+		return nil
+	})
+
 	root := &cobra.Command{
-		Use:     "sfdupes",
-		Short:   "Find candidate duplicate files by size and head/tail/content SHA-256",
-		Version: Version,
-		Args:    cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
+		Use:   "sfdupes",
+		Short: "Find candidate duplicate files by size and head/tail/content SHA-256",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if showVersion {
+				return printVersion(cmd, args)
+			}
+
 			// A missing subcommand prints usage and exits 2: cobra
 			// prints the usage text for the returned error, and run
 			// maps everything that is not a fatal error to exit 2.
@@ -122,6 +143,11 @@ func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
 	root.SetErr(stderr)
 	root.CompletionOptions.DisableDefaultCmd = true
 
+	// Cobra's built-in version flag prints through the help writer,
+	// stderr; this one prints to stdout.
+	root.Flags().BoolVarP(&showVersion, "version", "v", false,
+		"print the version to stdout")
+
 	var (
 		scanWorkers int
 		scanOneFS   bool
@@ -131,7 +157,13 @@ func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
 		Use:   cmdScan + " [--workers N] [-x] PATH...",
 		Short: "Walk trees and synchronize the scan database",
 		Args:  cobra.MinimumNArgs(1),
+		PreRunE: func(cmd *cobra.Command, _ []string) error {
+			return checkScanWorkers(cmd, scanWorkers)
+		},
 		RunE: runE(func(ctx context.Context, args []string) error {
+			ctx, stop := interruptContext(ctx)
+			defer stop()
+
 			return runScan(ctx, args, scanWorkers, scanOneFS)
 		}),
 	}
@@ -163,13 +195,26 @@ func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
 	return root
 }
 
-// runE adapts a subcommand implementation to cobra's RunE. Cobra
-// prints the error and the command's usage text for every error RunE
-// returns, but a subcommand that ran and failed has no usage problem
-// to report: both are silenced here, and the error is marked fatal so
-// that run reports it on stderr and exits 1 rather than 2. The command's
-// context is handed to the implementation: cancelling it unwinds the
-// scan's worker pools.
+// checkScanWorkers rejects a scan --workers value below 1. That is a
+// usage error reported in one line: cobra prints the returned message
+// without the usage text, and run exits 2.
+func checkScanWorkers(cmd *cobra.Command, workers int) error {
+	if workers >= 1 {
+		return nil
+	}
+
+	cmd.SilenceUsage = true
+
+	return fmt.Errorf("%w, got %d", errWorkersBelowOne, workers)
+}
+
+// runE adapts a subcommand implementation, or the version print, to
+// cobra's RunE. Cobra prints the error and the command's usage text for
+// every error RunE returns, but a subcommand that ran and failed has no
+// usage problem to report: both are silenced here, and the error is
+// marked fatal so that run reports it on stderr and exits 1 rather than
+// 2. The command's context is handed to the implementation: cancelling
+// it unwinds the scan's worker pools.
 func runE(
 	fn func(ctx context.Context, args []string) error,
 ) func(*cobra.Command, []string) error {

main_test.go

@@ -295,34 +295,108 @@ func TestRunUsageErrors(t *testing.T) {
 	}
 }
 
-// TestRunHelpAndVersionSucceed checks that the two informational flags
-// exit 0 and keep their human-facing output on stderr.
-func TestRunHelpAndVersionSucceed(t *testing.T) {
-	t.Parallel()
+func TestRunScanRejectsWorkersBelowOne(t *testing.T) {
+	// README §scan mode: --workers below 1 is a usage error reported in
+	// one line on stderr, before the scan opens the database.
+	for _, workers := range []string{"0", "-1"} {
+		t.Run(workers, func(t *testing.T) {
+			dbPath := testDBPath(t)
+			t.Setenv(databaseEnv, dbPath)
 
-	assertHumanOutput(t, "--help")
-	assertHumanOutput(t, "--version")
+			var stdout, stderr bytes.Buffer
+
+			args := []string{cmdScan, "--workers", workers, t.TempDir()}
+
+			code := run(args, &stdout, &stderr)
+			if code != exitUsage {
+				t.Errorf("run(%v) = %d, want %d", args, code, exitUsage)
+			}
+
+			want := "Error: --workers must be at least 1, got " + workers +
+				"\n"
+			if got := stderr.String(); got != want {
+				t.Errorf("stderr = %q, want %q", got, want)
+			}
+
+			if got := stdout.String(); got != "" {
+				t.Errorf("stdout = %q, want nothing (data only)", got)
+			}
+
+			_, err := os.Stat(dbPath)
+			if !errors.Is(err, fs.ErrNotExist) {
+				t.Errorf("stat %s: %v, want the database never created",
+					dbPath, err)
+			}
+		})
+	}
 }
 
-// assertHumanOutput runs sfdupes with one informational flag and checks
-// that it succeeds with its output on stderr and stdout untouched
-// (README design goal 4).
-func assertHumanOutput(t *testing.T, arg string) {
-	t.Helper()
+func TestRunHelp(t *testing.T) {
+	t.Parallel()
 
-	var stdout, stderr bytes.Buffer
+	// README §Subcommands: help goes to stderr, exits 0, and leaves
+	// stdout empty.
+	cases := [][]string{{"--help"}, {"-h"}, {cmdScan, "--help"}}
 
-	code := run([]string{arg}, &stdout, &stderr)
-	if code != exitOK {
-		t.Errorf("run(%s) = %d, want %d", arg, code, exitOK)
+	for _, args := range cases {
+		var stdout, stderr bytes.Buffer
+
+		code := run(args, &stdout, &stderr)
+		if code != exitOK {
+			t.Errorf("run(%v) = %d, want %d", args, code, exitOK)
+		}
+
+		if !strings.Contains(stderr.String(), usageMarker) {
+			t.Errorf("run(%v) stderr = %q, want the help text",
+				args, stderr.String())
+		}
+
+		if got := stdout.String(); got != "" {
+			t.Errorf("run(%v) stdout = %q, want nothing (data only)",
+				args, got)
+		}
+	}
+}
+
+func TestRunVersion(t *testing.T) {
+	t.Parallel()
+
+	// README §Subcommands: the version is one line on stdout, with
+	// nothing on stderr, and exits 0.
+	for _, arg := range []string{"--version", "-v"} {
+		var stdout, stderr bytes.Buffer
+
+		code := run([]string{arg}, &stdout, &stderr)
+		if code != exitOK {
+			t.Errorf("run(%s) = %d, want %d", arg, code, exitOK)
+		}
+
+		want := "sfdupes " + Version + "\n"
+		if got := stdout.String(); got != want {
+			t.Errorf("run(%s) stdout = %q, want %q", arg, got, want)
+		}
+
+		if got := stderr.String(); got != "" {
+			t.Errorf("run(%s) stderr = %q, want nothing", arg, got)
+		}
+	}
+}
+
+func TestRunVersionWriteFailureIsFatal(t *testing.T) {
+	t.Parallel()
+
+	// README §Error handling: a stdout write failure exits 1, reported
+	// in one line on stderr.
+	var stderr bytes.Buffer
+
+	code := run([]string{"--version"}, failingWriter{}, &stderr)
+	if code != exitFatal {
+		t.Errorf("run(--version) = %d, want %d", code, exitFatal)
 	}
 
-	if stderr.Len() == 0 {
-		t.Errorf("run(%s) wrote nothing to stderr", arg)
-	}
-
-	if got := stdout.String(); got != "" {
-		t.Errorf("stdout = %q, want nothing (data only)", got)
+	want := "sfdupes: write stdout: " + errWriteFailed.Error() + "\n"
+	if got := stderr.String(); got != want {
+		t.Errorf("stderr = %q, want %q", got, want)
 	}
 }
 

progress.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/schollz/progressbar/v3"
+	"golang.org/x/term"
 )
 
 // plainInterval is the minimum time between progress lines when stderr
@@ -24,24 +25,23 @@ const percentScale = 100
 
 // stderrIsTTY reports whether stderr is attached to a terminal.
 func stderrIsTTY() bool {
-	fi, err := os.Stderr.Stat()
-	if err != nil {
-		return false
-	}
-
-	return fi.Mode()&os.ModeCharDevice != 0
+	return term.IsTerminal(int(os.Stderr.Fd()))
 }
 
 // progress renders one scan pass's progress on stderr. On a TTY it
 // delegates to the progressbar library (spinner style when the total is
 // unknown, full bar with count/percent/rate/elapsed/ETA otherwise). When
 // stderr is not a TTY it emits no ANSI redraws: it prints a plain
-// one-line update no more often than every plainInterval.
+// one-line update as the pass starts, then no more often than every
+// plainInterval.
 //
-// All methods must be called from the main goroutine only. A nil
-// *progress is a valid no-display receiver: every method is a no-op,
-// so batched database flushes during the streaming pass can reuse the
-// update-pass helpers without rendering anything.
+// All methods must be called from the main goroutine only. On a TTY
+// the library also redraws a spinner from its own goroutine, several
+// times a second, so its count and elapsed time stay current while a
+// pass waits for its next item. A nil *progress is a valid
+// no-display receiver: every method is a no-op, so batched database
+// flushes during the streaming pass can reuse the update-pass helpers
+// without rendering anything.
 type progress struct {
 	label string
 	total int64 // -1 when unknown (walk pass)
@@ -53,10 +53,22 @@ type progress struct {
 
 func newProgress(label string, total int64) *progress {
 	p := &progress{label: label, total: total, start: time.Now()}
-	if !stderrIsTTY() {
+	if stderrIsTTY() {
+		p.bar = newBar(label, total)
+
 		return p
 	}
 
+	// Print the zero state at once: the first item may take minutes,
+	// and a pass must never look hung.
+	p.last = p.start
+	fmt.Fprintln(os.Stderr, p.plainLine())
+
+	return p
+}
+
+// newBar builds the TTY display for newProgress.
+func newBar(label string, total int64) *progressbar.ProgressBar {
 	opts := []progressbar.Option{
 		progressbar.OptionSetWriter(os.Stderr),
 		progressbar.OptionSetDescription(label),
@@ -81,9 +93,7 @@ func newProgress(label string, total int64) *progress {
 		)
 	}
 
-	p.bar = progressbar.NewOptions64(total, opts...)
-
-	return p
+	return progressbar.NewOptions64(total, opts...)
 }
 
 // increment records one completed item and refreshes the display.
@@ -113,21 +123,38 @@ func (p *progress) warnf(format string, args ...any) {
 		return
 	}
 
+	msg := escapePath(fmt.Sprintf(format, args...))
+
+	if p.bar != nil && p.total < 0 {
+		// The library also redraws a spinner from its own goroutine, so
+		// a direct write could land inside a redraw. The bar prints the
+		// warning itself, just before its next redraw.
+		_, _ = progressbar.Bprintln(p.bar, msg)
+
+		return
+	}
+
 	if p.bar != nil {
 		_ = p.bar.Clear()
 	}
 
-	fmt.Fprintln(os.Stderr, escapePath(fmt.Sprintf(format, args...)))
+	fmt.Fprintln(os.Stderr, msg)
 }
 
-// finish terminates the pass's display.
+// finish terminates the pass's display. A bar whose pass stopped short
+// of its total, as an interrupted one does, is left as last drawn; the
+// library's Finish would fill it up.
 func (p *progress) finish() {
 	if p == nil {
 		return
 	}
 
 	if p.bar != nil {
-		_ = p.bar.Finish()
+		if p.total >= 0 && p.count < p.total {
+			_ = p.bar.Exit()
+		} else {
+			_ = p.bar.Finish()
+		}
 
 		fmt.Fprintln(os.Stderr)
 

progress_test.go

@@ -0,0 +1,189 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// spinnerIdle comfortably outlasts the 100ms interval at which the
+// progressbar library redraws a spinner from its own goroutine.
+const spinnerIdle = 500 * time.Millisecond
+
+//nolint:paralleltest // replaces the process-wide os.Stderr
+func TestStderrIsTTYFalseForNonTerminals(t *testing.T) {
+	r, pipe, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	regular, err := os.Create(filepath.Join(t.TempDir(), "stderr"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	devNull, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	saved := os.Stderr
+
+	t.Cleanup(func() {
+		os.Stderr = saved
+
+		for _, f := range []*os.File{r, pipe, regular, devNull} {
+			_ = f.Close()
+		}
+	})
+
+	cases := map[string]*os.File{
+		"a pipe":         pipe,
+		"a regular file": regular,
+		os.DevNull:       devNull,
+	}
+
+	for name, f := range cases {
+		os.Stderr = f
+
+		if stderrIsTTY() {
+			t.Errorf("stderrIsTTY() = true with stderr on %s", name)
+		}
+	}
+}
+
+// TestNewProgressPrintsBeforeFirstItem checks that each pass shows its
+// zero state the moment it starts when stderr is not a terminal, and
+// that the next line still waits for plainInterval.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestNewProgressPrintsBeforeFirstItem(t *testing.T) {
+	stderr := captureStderr(t)
+
+	newProgress("walk", -1).increment()
+	newProgress("hash", 10).increment()
+
+	want := "walk: 0 files, elapsed 0s\n" +
+		"hash: [0/10] 0% 0 files/s elapsed 0s eta ?\n"
+	if got := stderr(); got != want {
+		t.Errorf("stderr = %q, want %q", got, want)
+	}
+}
+
+// newWalkSpinner returns the walk pass's terminal display, writing to
+// os.Stderr whether or not it is a terminal, and stops the library's
+// redraws when the test ends.
+func newWalkSpinner(t *testing.T) *progress {
+	t.Helper()
+
+	p := &progress{
+		label: "walk", total: -1, start: time.Now(),
+		bar: newBar("walk", -1),
+	}
+	t.Cleanup(p.finish)
+
+	return p
+}
+
+// TestProgressWarningsOnOwnLines drives the terminal display of the walk
+// pass through a run of warnings with no items between them, as when the
+// walk meets many unreadable paths, for several of the spinner's
+// redraws: every warning must land on a line of its own, never inside a
+// redraw.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestProgressWarningsOnOwnLines(t *testing.T) {
+	stderr := captureStderr(t)
+	p := newWalkSpinner(t)
+
+	// No pause between warnings: one written straight to stderr is
+	// garbled only if a redraw lands while it is being written.
+	issued := 0
+	for start := time.Now(); time.Since(start) < spinnerIdle; issued++ {
+		p.warnf("warning")
+	}
+
+	// The spinner prints the warnings at its next redraw.
+	time.Sleep(spinnerIdle)
+
+	// A terminal shows each line as the text after its last carriage
+	// return.
+	shown := 0
+
+	for line := range strings.SplitSeq(stderr(), "\n") {
+		if !strings.Contains(line, "warning") {
+			continue
+		}
+
+		shown++
+
+		if text := line[strings.LastIndex(line, "\r")+1:]; text != "warning" {
+			t.Errorf("terminal shows %q, want %q", text, "warning")
+		}
+	}
+
+	if shown != issued {
+		t.Errorf("%d warning lines, want %d", shown, issued)
+	}
+}
+
+// TestSpinnerShowsCountAfterBurst checks that once a burst of items
+// faster than the redraw limit is over, the walk display shows every
+// item completed while it waits for the next one.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestSpinnerShowsCountAfterBurst(t *testing.T) {
+	stderr := captureStderr(t)
+	p := newWalkSpinner(t)
+
+	for range 50 {
+		p.increment()
+	}
+
+	time.Sleep(spinnerIdle)
+
+	if shown := lastFrame(stderr()); !strings.Contains(shown, "(50/-,") {
+		t.Errorf("terminal shows %q, want a count of 50", shown)
+	}
+}
+
+// lastFrame returns what a terminal shows of the frames a bar drew: the
+// last one. The library starts each frame with a carriage return and
+// erases the previous one with spaces first.
+func lastFrame(out string) string {
+	var shown string
+
+	for frame := range strings.SplitSeq(out, "\r") {
+		if strings.TrimSpace(frame) != "" {
+			shown = frame
+		}
+	}
+
+	return shown
+}
+
+// TestBarStoppedShortKeepsCount checks that the terminal display of a
+// pass that stops before its total, as an interrupted one does, is left
+// as last drawn instead of being filled up.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestBarStoppedShortKeepsCount(t *testing.T) {
+	stderr := captureStderr(t)
+	p := &progress{
+		label: "hash", total: 10, start: time.Now(),
+		bar: newBar("hash", 10),
+	}
+
+	p.increment()
+
+	// Past the redraw limit, so the bar draws the next count.
+	time.Sleep(2 * barThrottle)
+	p.increment()
+	p.finish()
+
+	if shown := lastFrame(stderr()); !strings.Contains(shown, "(2/10,") {
+		t.Errorf("terminal shows %q, want a count of 2 of 10", shown)
+	}
+}

report_test.go

@@ -3,6 +3,8 @@ package main
 import (
 	"bytes"
 	"database/sql"
+	"errors"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -114,6 +116,29 @@ func TestRunReportEscapesPaths(t *testing.T) {
 	}
 }
 
+func TestReportStdoutFailsWhileReading(t *testing.T) {
+	// Each row holds two paths longer than dir, so the report is more
+	// than twice the stdout buffer and stdout fails while rows are
+	// still being read, not at the final flush.
+	dir := "/" + strings.Repeat("d", 4096)
+
+	recs := make([]scanRec, ioBufSize/len(dir))
+	for i := range recs {
+		recs[i] = scanRec{
+			size: 1, head: "h", tail: "t", content: "c",
+			path: fmt.Sprintf("%s/%d", dir, i),
+		}
+	}
+
+	t.Setenv(databaseEnv, seedDatabase(t, recs))
+
+	err := runReport(t.Context(), failingWriter{})
+	if !errors.Is(err, errWriteFailed) ||
+		!strings.HasPrefix(err.Error(), "write stdout: ") {
+		t.Errorf("error = %v, want write stdout: %v", err, errWriteFailed)
+	}
+}
+
 func TestRunReportsIgnoreInsertionOrder(t *testing.T) {
 	// README §Constraints: identical database contents give identical
 	// output, whatever order the records were inserted in.
@@ -301,11 +326,13 @@ func TestDupeGroupsMtimeExcluded(t *testing.T) {
 func TestDupeGroupsTieBreak(t *testing.T) {
 	t.Parallel()
 
+	// The hashes sort opposite to the first paths, so ordering the
+	// groups by hash instead of by first path fails this test.
 	recs := []scanRec{
-		{size: 50, head: "b", tail: "b", content: "b", path: "/beta/2"},
-		{size: 50, head: "b", tail: "b", content: "b", path: "/beta/1"},
-		{size: 50, head: "a", tail: "a", content: "a", path: "/alpha/2"},
-		{size: 50, head: "a", tail: "a", content: "a", path: "/alpha/1"},
+		{size: 50, head: "a", tail: "a", content: "a", path: "/beta/2"},
+		{size: 50, head: "a", tail: "a", content: "a", path: "/beta/1"},
+		{size: 50, head: "b", tail: "b", content: "b", path: "/alpha/2"},
+		{size: 50, head: "b", tail: "b", content: "b", path: "/alpha/1"},
 	}
 
 	groups := dupeGroupsOf(t, recs)

scan.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -57,6 +58,10 @@ const sampleWindow = 1024 * 1024
 // and hash worker pools.
 const workQueueDepth = 1024
 
+// errInterrupted reports a scan stopped by SIGINT or SIGTERM. runScan
+// has already printed its line, so run prints nothing more.
+var errInterrupted = errors.New("scan interrupted")
+
 // fileRec carries one statted file between the scan phases. dev and
 // ino identify the underlying inode so hard-linked paths can share
 // one read; both are zero when the platform exposes no inode.
@@ -90,15 +95,14 @@ type fileMeta struct {
 // scan fails before it walks the filesystem or opens the database.
 // Errors are returned rather than exiting, so that the deferred close —
 // which takes the database out of WAL mode — always runs, and the lock
-// is released after it. Cancelling ctx unwinds the worker pools and
-// aborts the scan with the context's error.
+// is released after it. When ctx is cancelled, as by the SIGINT or
+// SIGTERM that interruptContext catches, the scan keeps what it has
+// hashed (see syncScan), prints how many files its walk reached, and
+// returns errInterrupted. workers must be at least 1; the scan command
+// rejects anything less.
 func runScan(ctx context.Context, roots []string, workers int,
 	oneFS bool,
 ) error {
-	if workers < 1 {
-		workers = 1
-	}
-
 	roots, err := resolveRoots(roots)
 	if err != nil {
 		return err
@@ -114,6 +118,12 @@ func runScan(ctx context.Context, roots []string, workers int,
 	defer func() { _ = lock.Close() }()
 
 	db, err := openScanDatabase(ctx, dbPath)
+	if err != nil && ctx.Err() != nil {
+		// Interrupted while opening; SQLite may report that with an
+		// error of its own rather than the context's.
+		return interrupted(0)
+	}
+
 	if err != nil {
 		return err
 	}
@@ -121,6 +131,10 @@ func runScan(ctx context.Context, roots []string, workers int,
 	defer closeScanDatabase(ctx, db, dbPath)
 
 	st, err := syncScan(ctx, db, roots, workers, oneFS)
+	if errors.Is(err, context.Canceled) {
+		return interrupted(st.walked)
+	}
+
 	if err != nil {
 		return fmt.Errorf("update database %s: %w", dbPath, err)
 	}
@@ -134,6 +148,34 @@ func runScan(ctx context.Context, roots []string, workers int,
 	return nil
 }
 
+// interruptContext returns a copy of ctx that the first SIGINT or
+// SIGTERM cancels; the scan command runs the scan under it. stop
+// releases the signals.
+func interruptContext(ctx context.Context) (context.Context, func()) {
+	// A SIGINT ignored from the start, as by a script's background job,
+	// stays ignored.
+	signals := []os.Signal{syscall.SIGTERM}
+	if !signal.Ignored(syscall.SIGINT) {
+		signals = append(signals, syscall.SIGINT)
+	}
+
+	ctx, stop := signal.NotifyContext(ctx, signals...)
+
+	// Stopping restores the default handling, so a second signal ends
+	// the process at once.
+	context.AfterFunc(ctx, stop)
+
+	return ctx, stop
+}
+
+// interrupted prints the line for a scan stopped by a signal after its
+// walk reached walked files, and returns errInterrupted.
+func interrupted(walked int) error {
+	fmt.Fprintf(os.Stderr, "scan: interrupted after %d files\n", walked)
+
+	return errInterrupted
+}
+
 // resolveRoots converts each PATH operand to an absolute, lexically
 // cleaned path (symlinks are not resolved) and verifies that it
 // exists. Database records are keyed by absolute path, so scan results
@@ -187,8 +229,9 @@ func pruneRoots(roots []string) []string {
 }
 
 // scanStats summarizes one scan's database synchronization for the
-// final stderr summary.
+// final stderr summary, or for the line an interrupted scan prints.
 type scanStats struct {
+	walked    int // files the walk reached
 	added     int
 	updated   int
 	removed   int
@@ -210,7 +253,30 @@ type scanState struct {
 	st        scanStats
 }
 
-// syncScan synchronizes the database with the filesystem under roots
+// syncScan synchronizes the database with the filesystem under roots;
+// see runPhases. When ctx is cancelled, as by an interrupt, it commits
+// the hashed records still waiting in the batch, starts no other write
+// or deletion, and returns the cancellation.
+func syncScan(ctx context.Context, db *sql.DB, roots []string,
+	workers int, oneFS bool,
+) (scanStats, error) {
+	s := &scanState{db: db}
+
+	err := s.runPhases(ctx, roots, workers, oneFS)
+	if err == nil || ctx.Err() == nil {
+		return s.st, err
+	}
+
+	// The one write made after the cancellation, so it cannot use ctx.
+	err = applyChanges(context.WithoutCancel(ctx), db, s.batch, nil, nil)
+	if err != nil {
+		return s.st, err
+	}
+
+	return s.st, ctx.Err()
+}
+
+// runPhases synchronizes the database with the filesystem under roots
 // in four sequential phases: walk (enumerate and stat every file,
 // building a complete size census), hash (read only the new or
 // changed — or previously unhashed — files whose size at least one
@@ -223,48 +289,41 @@ type scanState struct {
 // their content hash. Operands the walk cannot start from are dropped
 // first, so the records beneath them count as outside the roots unless
 // they lie under another root.
-func syncScan(ctx context.Context, db *sql.DB, roots []string,
+func (s *scanState) runPhases(ctx context.Context, roots []string,
 	workers int, oneFS bool,
-) (scanStats, error) {
-	s := &scanState{db: db}
-
+) error {
 	// Types are checked before pruning so that an operand under a
 	// dropped one is still scanned, not dropped as lying under it.
 	roots = pruneRoots(s.walkableRoots(roots))
 
 	err := s.loadIndex(ctx, roots)
 	if err != nil {
-		return s.st, err
+		return err
 	}
 
 	changed, unhashed := s.walkPhase(startWalk(ctx, roots, oneFS, workers))
 
 	// A cancelled walk stops early, so its size census covers only part
-	// of the roots, and every file it never reached looks vanished to
-	// the update phase. Defence in depth rather than the only barrier:
-	// that phase would today fail on its first BeginTx with the same
-	// cancelled context before deleting anything. But it is the barrier
-	// that survives a later decision to let an interrupted scan commit
-	// what it has, and it turns a confusing failure deep in the update
-	// phase into a clean abort at the phase boundary.
+	// of the roots, and every file it never reached would look vanished
+	// to the update phase. Stop before anything is written or deleted.
 	err = ctx.Err()
 	if err != nil {
-		return s.st, err
+		return err
 	}
 
 	s.partition(changed, unhashed)
 
 	err = s.hashPhase(ctx, workers)
 	if err != nil {
-		return s.st, err
+		return err
 	}
 
 	err = s.updatePhase(ctx)
 	if err != nil {
-		return s.st, err
+		return err
 	}
 
-	return s.st, s.contentPhase(ctx, workers)
+	return s.contentPhase(ctx, workers)
 }
 
 // walkableRoots returns the operands the walk can start from: regular
@@ -349,6 +408,7 @@ func (s *scanState) walkPhase(
 		}
 
 		s.sizes = append(s.sizes, ev.rec.size)
+		s.st.walked++
 
 		prog.increment()
 
@@ -552,16 +612,22 @@ func (s *scanState) recordRun(ctx context.Context, r hashResult) error {
 }
 
 // commitFullBatch commits the running batch once it holds
-// updateBatchSize records.
+// updateBatchSize records. A batch that fails to commit is kept: the
+// commit fails when the scan is interrupted, and syncScan then commits
+// the batch itself.
 func (s *scanState) commitFullBatch(ctx context.Context) error {
 	if len(s.batch) < updateBatchSize {
 		return nil
 	}
 
 	err := applyBatch(ctx, s.db, s.batch, nil, nil)
+	if err != nil {
+		return err
+	}
+
 	s.batch = s.batch[:0]
 
-	return err
+	return nil
 }
 
 // updatePhase writes the scan's tail under one progress display: the
@@ -1004,6 +1070,12 @@ func walkOneDir(ctx context.Context, job dirJob, oneFS bool,
 	var subs []dirJob
 
 	for _, e := range entries {
+		// A cancelled scan wants nothing more from this directory: stop
+		// rather than lstat the rest of a large one.
+		if ctx.Err() != nil {
+			return nil
+		}
+
 		p := filepath.Join(job.path, e.Name())
 
 		if e.IsDir() {

scan_test.go

@@ -6,14 +6,18 @@ import (
 	"crypto/sha256"
 	"database/sql"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"runtime"
 	"slices"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 )
@@ -456,7 +460,7 @@ func TestScanContentWithinOperand(t *testing.T) {
 	added := sparseFile(t, dir, "d2", headTailMin)
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 1, unchanged: 2}) {
+	if st != (scanStats{walked: 3, added: 1, unchanged: 2}) {
 		t.Fatalf("rescan stats = %+v, want 1 added 2 unchanged", st)
 	}
 
@@ -502,7 +506,7 @@ func TestScanContentStalePartners(t *testing.T) {
 	sparseFile(t, dirB, "changed-copy", headTailMin+1)
 
 	st := syncTree(t, db, dirB)
-	if st != (scanStats{added: 2}) {
+	if st != (scanStats{walked: 2, added: 2}) {
 		t.Errorf("stats = %+v, want 2 added and nothing skipped", st)
 	}
 
@@ -559,7 +563,7 @@ func TestScanContentHashedStalePartners(t *testing.T) {
 	b := sparseFile(t, t.TempDir(), "copy", headTailMin)
 
 	st := syncTree(t, db, filepath.Dir(b))
-	if st != (scanStats{added: 1}) {
+	if st != (scanStats{walked: 1, added: 1}) {
 		t.Errorf("stats = %+v, want 1 added and nothing skipped", st)
 	}
 
@@ -599,7 +603,7 @@ func TestScanContentReadFailure(t *testing.T) {
 	b := sparseFile(t, dirB, "b", headTailMin)
 
 	st := syncTree(t, db, dirB)
-	if st != (scanStats{added: 1, skipped: 1}) {
+	if st != (scanStats{walked: 1, added: 1, skipped: 1}) {
 		t.Fatalf("stats = %+v, want 1 added 1 skipped", st)
 	}
 
@@ -613,7 +617,7 @@ func TestScanContentReadFailure(t *testing.T) {
 	}
 
 	st = syncTree(t, db, dirB)
-	if st != (scanStats{unchanged: 1}) {
+	if st != (scanStats{walked: 1, unchanged: 1}) {
 		t.Fatalf("rescan stats = %+v, want 1 unchanged", st)
 	}
 
@@ -659,7 +663,7 @@ func TestScanContentCheckError(t *testing.T) {
 	b := sparseFile(t, t.TempDir(), "b", headTailMin)
 
 	st := syncTree(t, db, filepath.Dir(b))
-	if st != (scanStats{added: 1, skipped: 1}) {
+	if st != (scanStats{walked: 1, added: 1, skipped: 1}) {
 		t.Fatalf("stats = %+v, want 1 added 1 skipped", st)
 	}
 
@@ -687,7 +691,7 @@ func TestScanContentHardlinks(t *testing.T) {
 	c := sparseFile(t, dir, "copy", headTailMin)
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 3}) {
+	if st != (scanStats{walked: 3, added: 3}) {
 		t.Fatalf("stats = %+v, want 3 added", st)
 	}
 
@@ -910,6 +914,159 @@ func TestDeviceOfInfo(t *testing.T) {
 	}
 }
 
+// dirEntryFor returns the fs.DirEntry for name within dir, obtained via
+// the same os.ReadDir the walk uses, so it carries a real Info().
+func dirEntryFor(t *testing.T, dir, name string) fs.DirEntry {
+	t.Helper()
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, e := range entries {
+		if e.Name() == name {
+			return e
+		}
+	}
+
+	t.Fatalf("entry %q not found in %q", name, dir)
+
+	return nil
+}
+
+// callSubdirJob runs subdirJob against e under parent, collecting any
+// warning events it emits (subdirJob emits at most one).
+func callSubdirJob(t *testing.T, p string, e fs.DirEntry,
+	parent dirJob, oneFS bool,
+) (dirJob, bool, []walkEvent) {
+	t.Helper()
+
+	events := make(chan walkEvent, 1)
+	job, ok := subdirJob(t.Context(), p, e, parent, oneFS, events)
+	close(events)
+
+	var evs []walkEvent
+	for ev := range events {
+		evs = append(evs, ev)
+	}
+
+	return job, ok, evs
+}
+
+// TestSubdirJobOneFilesystem exercises the -x boundary check in
+// subdirJob directly, so no second real filesystem is needed. The
+// subdirectory's real device is compared against a fabricated operand
+// device.
+func TestSubdirJobOneFilesystem(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	sub := filepath.Join(dir, "sub")
+
+	err := os.Mkdir(sub, 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := os.Lstat(sub)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dev, ok := deviceOfInfo(info)
+	if !ok {
+		t.Skip("platform exposes no device id")
+	}
+
+	// A device the subdirectory is not on, standing in for an operand
+	// rooted on a different filesystem.
+	otherDev := dev + 1
+	e := dirEntryFor(t, dir, "sub")
+
+	cases := []struct {
+		name   string
+		oneFS  bool
+		parent dirJob
+		wantOK bool
+	}{
+		// -x on, subdirectory on a different device than its operand:
+		// descent is refused.
+		{"reject across boundary", true,
+			dirJob{rootDev: otherDev, rootDevOK: true}, false},
+		// -x on but the operand's own device is unknown: the boundary
+		// check is bypassed and descent proceeds.
+		{"bypass when root device unknown", true,
+			dirJob{rootDev: otherDev, rootDevOK: false}, true},
+		// Default (no -x): boundaries are crossed even onto a different
+		// device.
+		{"cross by default", false,
+			dirJob{rootDev: otherDev, rootDevOK: true}, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			job, ok, evs := callSubdirJob(t, sub, e, tc.parent, tc.oneFS)
+			if ok != tc.wantOK {
+				t.Fatalf("accepted = %v, want %v", ok, tc.wantOK)
+			}
+
+			if len(evs) != 0 {
+				t.Fatalf("unexpected events: %+v", evs)
+			}
+
+			// The accepted job must carry the operand's device down, or -x
+			// stops checking below the first level.
+			want := dirJob{
+				path:      sub,
+				rootDev:   tc.parent.rootDev,
+				rootDevOK: tc.parent.rootDevOK,
+			}
+			if ok && job != want {
+				t.Fatalf("job = %+v, want %+v", job, want)
+			}
+		})
+	}
+}
+
+// errInfoUnavailable is returned by errDirEntry.Info().
+var errInfoUnavailable = errors.New("info unavailable")
+
+// errDirEntry is a directory entry whose Info() always fails, driving
+// subdirJob's stat-error branch deterministically.
+type errDirEntry struct{ name string }
+
+func (e errDirEntry) Name() string { return e.name }
+func (errDirEntry) IsDir() bool    { return true }
+func (errDirEntry) Type() fs.FileMode {
+	return fs.ModeDir
+}
+
+func (errDirEntry) Info() (fs.FileInfo, error) {
+	return nil, errInfoUnavailable
+}
+
+// TestSubdirJobStatError asserts that when a subdirectory's Info()
+// fails under -x, subdirJob warns and refuses descent.
+func TestSubdirJobStatError(t *testing.T) {
+	t.Parallel()
+
+	p := "/does/not/matter/sub"
+
+	_, ok, evs := callSubdirJob(t, p, errDirEntry{name: "sub"},
+		dirJob{rootDev: 1, rootDevOK: true}, true)
+	if ok {
+		t.Fatal("descent accepted after stat error, want refused")
+	}
+
+	if len(evs) != 1 || !evs[0].fail || !strings.Contains(evs[0].warn, p) {
+		t.Fatalf("want one warning naming the path, got %+v", evs)
+	}
+}
+
 // buildSmokeTree recreates the README smoke-test filesystem layout
 // with deterministic content and returns the tree root.
 func buildSmokeTree(t *testing.T) string {
@@ -1058,7 +1215,7 @@ func TestScanPipeline(t *testing.T) {
 	db := openTestDB(t)
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: smokeTreeFiles}) {
+	if st != (scanStats{walked: smokeTreeFiles, added: smokeTreeFiles}) {
 		t.Fatalf("stats = %+v, want %d added only", st, smokeTreeFiles)
 	}
 
@@ -1081,7 +1238,7 @@ func TestSyncScanUnchangedReuse(t *testing.T) {
 	writeFile(t, dir, "b.bin", pattern(2, 600))
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 2}) {
+	if st != (scanStats{walked: 2, added: 2}) {
 		t.Fatalf("first scan stats = %+v, want 2 added", st)
 	}
 
@@ -1095,7 +1252,7 @@ func TestSyncScanUnchangedReuse(t *testing.T) {
 	}
 
 	st = syncTree(t, db, dir)
-	if st != (scanStats{unchanged: 2}) {
+	if st != (scanStats{walked: 2, unchanged: 2}) {
 		t.Fatalf("rescan stats = %+v, want 2 unchanged", st)
 	}
 
@@ -1124,7 +1281,7 @@ func TestSyncScanMtimeBump(t *testing.T) {
 	}
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{updated: 1}) {
+	if st != (scanStats{walked: 1, updated: 1}) {
 		t.Fatalf("mtime-bump stats = %+v, want 1 updated", st)
 	}
 
@@ -1152,7 +1309,7 @@ func TestSyncScanAddRemove(t *testing.T) {
 	}
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 1, removed: 1, unchanged: 1}) {
+	if st != (scanStats{walked: 2, added: 1, removed: 1, unchanged: 1}) {
 		t.Fatalf("add/remove stats = %+v, want 1 added 1 removed 1 unchanged",
 			st)
 	}
@@ -1269,7 +1426,7 @@ func TestSyncScanOverlappingRoots(t *testing.T) {
 	// A file reachable via two overlapping operands is deduplicated
 	// by path in the shared walk and processed once.
 	st := syncTree(t, db, dir, filepath.Join(dir, "sub"))
-	if st != (scanStats{added: 1}) {
+	if st != (scanStats{walked: 1, added: 1}) {
 		t.Fatalf("stats = %+v, want 1 added", st)
 	}
 
@@ -1290,7 +1447,7 @@ func TestScanSkipsUniqueSizes(t *testing.T) {
 	// Neither size is shared, so neither file is read: both records
 	// are written without hashes and no duplicates are reported.
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 2}) {
+	if st != (scanStats{walked: 2, added: 2}) {
 		t.Fatalf("stats = %+v, want 2 added", st)
 	}
 
@@ -1312,7 +1469,7 @@ func TestScanSkipsUniqueSizes(t *testing.T) {
 	c := writeFile(t, dir, "c.bin", pattern(1, 500))
 
 	st = syncTree(t, db, dir)
-	if st != (scanStats{added: 1, updated: 1, unchanged: 1}) {
+	if st != (scanStats{walked: 3, added: 1, updated: 1, unchanged: 1}) {
 		t.Fatalf("rescan stats = %+v, want 1 added 1 updated 1 unchanged",
 			st)
 	}
@@ -1376,7 +1533,7 @@ func TestScanHardlinksReadOnce(t *testing.T) {
 	}
 
 	st := syncTree(t, db, dir)
-	if st != (scanStats{added: 2}) {
+	if st != (scanStats{walked: 2, added: 2}) {
 		t.Fatalf("stats = %+v, want 2 added", st)
 	}
 
@@ -1498,6 +1655,13 @@ func injectWriteFailure(t *testing.T, path string) {
 func baselineGoroutines(t *testing.T) int {
 	t.Helper()
 
+	// The first scan command in a process starts os/signal's goroutine,
+	// which never exits. Start it now, so the baseline counts it
+	// instead of the scan seeming to leave it behind.
+	ch := make(chan os.Signal, 1)
+	signal.Notify(ch, syscall.SIGINT)
+	signal.Stop(ch)
+
 	deadline := time.Now().Add(goroutineSettle)
 	last := runtime.NumGoroutine()