Refuse an unversioned database that already has a files table (closes #11)

An unversioned database (user_version 0) that already contains a files
table was not created by this build; it is a foreign or partially
initialized file. Adopting it silently could corrupt unrelated data, so
createSchema now checks for a files table first and, when one exists,
returns the schema-version error telling the operator to remove the file
and rescan. A genuinely empty database is still created and stamped as
before.

Model: opus-4-8 (implementation); opus-5-5 (rebase)

README.md

@@ -113,8 +113,7 @@ Goals, in order:
     `sfdupes`.
 -   Dependencies: standard library, `github.com/spf13/cobra` for the
     CLI, **one progress-bar library**
-    (`github.com/schollz/progressbar/v3`), `golang.org/x/term` to tell
-    whether stderr is a terminal, and **one SQLite driver**
+    (`github.com/schollz/progressbar/v3`), and **one SQLite driver**
     (`modernc.org/sqlite`, pure Go, so builds keep cgo disabled).
     `github.com/spf13/viper` is permitted if configuration-file support
     is ever needed, but is not currently used. No other third-party
@@ -153,28 +152,16 @@ All three subcommands operate on a single SQLite database file:
     use. `report` and `trees` require an existing database; a missing
     database file is a fatal error (exit 1) telling the user to run
     `scan` first.
--   While `scan` runs, the database is in WAL journal mode with a busy
-    timeout, so running a report while a cron `scan` is in progress is
-    safe. The filesystem is authoritative; the database is an
-    eventually-consistent reflection of it. Hashed records are
-    committed in batched transactions while the scan is still running
-    (keeping the WAL small and letting concurrent reports observe
-    progress), so a report may see a scan's changes partially applied,
-    and a scan that dies partway leaves a valid database holding
-    everything hashed so far; the next scan skips those records and
-    converges toward the filesystem.
--   `scan` switches the database back to rollback-journal mode when it
-    closes it, so between scans the database file alone holds the whole
-    database. Each switch needs the database to itself: a `scan` that
-    starts while a report is still reading waits for it up to the
-    10-second busy timeout, then fails; a `scan` that ends while a
-    report has the database open warns and leaves the database in WAL
-    mode until the next scan.
--   `report` and `trees` open the database read-only and need only read
-    access to the database file, and no write access to its directory.
-    While the database is in WAL mode they also read the `-wal` and
-    `-shm` files beside it, which SQLite creates with the database
-    file's permissions.
+-   The database uses WAL journal mode and a busy timeout, so running a
+    report while a cron `scan` is in progress is safe. The filesystem
+    is authoritative; the database is an eventually-consistent
+    reflection of it. Hashed records are committed in batched
+    transactions while the scan is still running (keeping the WAL
+    small and letting concurrent reports observe progress), so a
+    report may see a scan's changes partially applied, and a scan
+    that dies partway leaves a valid database holding everything
+    hashed so far; the next scan skips those records and converges
+    toward the filesystem.
 -   Schema (`PRAGMA user_version` is the schema version, currently 1; a
     database with any other version is a fatal error):
 
@@ -558,16 +545,10 @@ hash: [12345/98765] 12% |████      | 92 files/s elapsed 2:32 eta 17:54
 
 Additional requirements:
 
--   When stderr is not a terminal (a pipe, a file, `/dev/null`), do not
-    emit ANSI redraws: print a plain one-line progress update the moment
-    each phase starts, then no more often than every 5 seconds.
+-   When stderr is not a TTY, do not emit ANSI redraws: print a plain
+    one-line progress update no more often than every 5 seconds instead.
 -   Progress updates are driven from the main goroutine and must be
-    non-blocking with respect to the worker pool. On a terminal the
-    spinner-style displays also redraw on their own several times a
-    second, so their count and elapsed time stay current while a phase
-    waits for its next item.
--   A warning printed during a phase always lands on a line of its own,
-    never inside the progress display.
+    non-blocking with respect to the worker pool.
 -   `report` and `trees` modes need no progress display, only their
     stderr summaries.
 

TODO.md

@@ -29,13 +29,9 @@
 
 # Completed Steps
 
-- progress prints at once on a non-terminal, uses a real terminal test,
-  and prints warnings through a spinner instead of racing its redraw
-  (2026-10-03, https://git.eeqj.de/sneak/sfdupes/issues/13)
-
-- `report` and `trees` open the database read-only, and `scan` leaves it
-  out of WAL mode, so reading needs only read access (2026-10-03, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/8)
+- refuse an unversioned database that already has a `files` table with
+  a clear schema-version error (2026-10-03,
+  https://git.eeqj.de/sneak/sfdupes/issues/11)
 
 - escape tabs, newlines, carriage returns and backslashes in report,
   trees and warning paths; the root directory's path is `/`

db.go

@@ -74,24 +74,16 @@ func databasePath() string {
 	return defaultDatabasePath
 }
 
-// scanParams are the connection parameters for scan: read-write, with
-// WAL journaling and a busy timeout, so a report can run while a cron
-// scan is in progress. closeScanDatabase leaves WAL mode again.
-const scanParams = "_pragma=busy_timeout(10000)" +
-	"&_pragma=journal_mode(WAL)" +
-	"&_pragma=synchronous(NORMAL)"
+// openDB opens the SQLite database at path with WAL journaling and a
+// busy timeout, so a report can run while a cron scan is in progress.
+// It does not create or verify the schema.
+func openDB(path string) (*sql.DB, error) {
+	dsn := "file:" + path +
+		"?_pragma=busy_timeout(10000)" +
+		"&_pragma=journal_mode(WAL)" +
+		"&_pragma=synchronous(NORMAL)"
 
-// reportParams are the connection parameters for report and trees:
-// read-only, with the same busy timeout. They set no journal mode,
-// because setting one is a write.
-const reportParams = "mode=ro" +
-	"&_pragma=busy_timeout(10000)" +
-	"&_pragma=query_only(1)"
-
-// openDB opens the SQLite database at path with the connection
-// parameters params. It does not create or verify the schema.
-func openDB(path, params string) (*sql.DB, error) {
-	db, err := sql.Open("sqlite", "file:"+path+"?"+params)
+	db, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		return nil, fmt.Errorf("open database %s: %w", path, err)
 	}
@@ -112,7 +104,7 @@ func openScanDatabase(ctx context.Context, path string) (*sql.DB, error) {
 		return nil, fmt.Errorf("create database directory: %w", err)
 	}
 
-	db, err := openDB(path, scanParams)
+	db, err := openDB(path)
 	if err != nil {
 		return nil, err
 	}
@@ -127,24 +119,6 @@ func openScanDatabase(ctx context.Context, path string) (*sql.DB, error) {
 	return db, nil
 }
 
-// closeScanDatabase switches the database at path from WAL back to
-// rollback-journal mode and closes it. Out of WAL mode the database
-// file alone holds the whole database, so a reader needs no -wal or
-// -shm file beside it, nor write access to create them. The switch
-// fails while a report has the database open; the database then stays
-// in WAL mode, still readable, until a later scan closes it.
-func closeScanDatabase(ctx context.Context, db *sql.DB, path string) {
-	// Runs on the way out of a cancelled scan too.
-	_, err := db.ExecContext(context.WithoutCancel(ctx),
-		"PRAGMA journal_mode = DELETE")
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "scan: database %s left in WAL mode: %v\n",
-			path, err)
-	}
-
-	_ = db.Close()
-}
-
 // openReportDatabase opens an existing database for the report and
 // trees subcommands. A missing database file is an error directing the
 // user to run scan first; the schema version must match exactly.
@@ -160,7 +134,7 @@ func openReportDatabase(ctx context.Context,
 		return nil, fmt.Errorf("database: %w", err)
 	}
 
-	db, err := openDB(path, reportParams)
+	db, err := openDB(path)
 	if err != nil {
 		return nil, err
 	}
@@ -202,9 +176,30 @@ func initSchema(ctx context.Context, db *sql.DB) error {
 }
 
 // createSchema applies the schema to a fresh database and stamps the
-// schema version.
+// schema version. A database with user_version 0 that already has a
+// files table was not created by this build — a foreign or partially
+// initialized file. Adopting it silently could corrupt unrelated data,
+// so that is a fatal schema-version error telling the operator to
+// remove the file and rescan.
 func createSchema(ctx context.Context, db *sql.DB) error {
-	_, err := db.ExecContext(ctx, createTableSQL)
+	var name string
+
+	err := db.QueryRowContext(ctx,
+		"SELECT name FROM sqlite_master "+
+			"WHERE type = 'table' AND name = 'files'").Scan(&name)
+
+	switch {
+	case err == nil:
+		return fmt.Errorf(
+			"has a files table but no schema version; "+
+				"remove the file and rescan: %w", errSchemaVersion)
+	case errors.Is(err, sql.ErrNoRows):
+		// Genuinely empty: create the schema below.
+	default:
+		return fmt.Errorf("check for files table: %w", err)
+	}
+
+	_, err = db.ExecContext(ctx, createTableSQL)
 	if err != nil {
 		return fmt.Errorf("create schema: %w", err)
 	}

db_test.go

@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -79,6 +78,38 @@ func TestOpenScanDatabaseCreates(t *testing.T) {
 	}
 }
 
+func TestOpenScanDatabaseUnversionedForeign(t *testing.T) {
+	t.Parallel()
+
+	path := testDBPath(t)
+
+	// A database that has a files table but user_version 0 — a foreign
+	// or partially initialized file. scan must refuse it with a clear
+	// schema-version error, not adopt it and not emit a raw SQLite
+	// "table files already exists".
+	db, err := openDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = db.ExecContext(t.Context(), "CREATE TABLE files (x INTEGER)")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_ = db.Close()
+
+	_, err = openScanDatabase(t.Context(), path)
+	if !errors.Is(err, errSchemaVersion) {
+		t.Fatalf("err = %v, want errSchemaVersion", err)
+	}
+
+	if !strings.Contains(err.Error(), "remove the file and rescan") {
+		t.Fatalf("err = %v, want it to tell the operator to remove and rescan",
+			err)
+	}
+}
+
 func TestOpenReportDatabaseMissing(t *testing.T) {
 	t.Parallel()
 
@@ -131,49 +162,6 @@ func TestOpenReportDatabaseOK(t *testing.T) {
 	_ = db.Close()
 }
 
-func TestCloseScanDatabaseWhileReportOpen(t *testing.T) {
-	t.Parallel()
-
-	// A report holding the database open stops scan from taking it out
-	// of WAL mode. The -wal and -shm files must then stay beside it, so
-	// that a later report still needs only read access.
-	path := testDBPath(t)
-
-	scanDB, err := openScanDatabase(t.Context(), path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	reportDB, err := openReportDatabase(t.Context(), path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	closeScanDatabase(t.Context(), scanDB, path)
-
-	_ = reportDB.Close()
-
-	_, err = os.Stat(path + "-wal")
-	if err != nil {
-		t.Fatalf("no -wal left: the switch out of WAL mode was not "+
-			"stopped: %v", err)
-	}
-
-	makeReadOnly(t, path)
-
-	reportDB, err = openReportDatabase(t.Context(), path)
-	if err != nil {
-		t.Fatalf("openReportDatabase: %v", err)
-	}
-
-	defer func() { _ = reportDB.Close() }()
-
-	_, err = loadFileRows(t.Context(), reportDB)
-	if err != nil {
-		t.Fatalf("loadFileRows: %v", err)
-	}
-}
-
 func TestApplyChangesRoundTrip(t *testing.T) {
 	t.Parallel()
 

go.mod

@@ -5,7 +5,6 @@ go 1.25.7
 require (
 	github.com/schollz/progressbar/v3 v3.19.1
 	github.com/spf13/cobra v1.10.2
-	golang.org/x/term v0.44.0
 	modernc.org/sqlite v1.54.0
 )
 
@@ -20,6 +19,7 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
 	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

main_test.go

@@ -44,44 +44,6 @@ func assertNoSidecars(t *testing.T, path string) {
 	}
 }
 
-// makeReadOnly takes write permission away from the database at path,
-// from any WAL sidecar beside it, and from their directory, as for a
-// user reading a database that a root cron scan keeps. Root ignores
-// file permissions, so it skips the test when run as root.
-func makeReadOnly(t *testing.T, path string) {
-	t.Helper()
-
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores file permissions")
-	}
-
-	err := os.Chmod(path, 0o400)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, suffix := range walSuffixes {
-		err = os.Chmod(path+suffix, 0o400)
-		if err != nil && !errors.Is(err, fs.ErrNotExist) {
-			t.Fatal(err)
-		}
-	}
-
-	dir := filepath.Dir(path)
-
-	//nolint:gosec // reaching the database needs the search bit
-	err = os.Chmod(dir, 0o500)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Runs before t.TempDir's own cleanup, which must delete the files.
-	t.Cleanup(func() {
-		//nolint:gosec // removing the directory needs its search bit back
-		_ = os.Chmod(dir, 0o700)
-	})
-}
-
 // captureStdout redirects os.Stdout to a file for the rest of the test
 // and returns a function reading back everything written to it. Only
 // machine-readable data belongs on stdout (README design goal 4), so
@@ -129,13 +91,13 @@ func captureStdout(t *testing.T) func() string {
 // brokenDatabase writes a database that opens cleanly and passes the
 // schema-version check but has no files table, so the first query
 // fails with the database already open: a fatal error on a path that
-// owns an open database. It closes the database the way scan does.
+// owns an open database.
 func brokenDatabase(t *testing.T) string {
 	t.Helper()
 
 	path := testDBPath(t)
 
-	db, err := openDB(path, scanParams)
+	db, err := openDB(path)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -146,7 +108,10 @@ func brokenDatabase(t *testing.T) string {
 		t.Fatal(err)
 	}
 
-	closeScanDatabase(t.Context(), db, path)
+	err = db.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	return path
 }
@@ -179,10 +144,7 @@ func TestOpenDatabaseKeepsWALWhileOpen(t *testing.T) {
 
 func TestRunFatalAfterOpenClosesDatabase(t *testing.T) {
 	// Every subcommand that owns an open database must close it when
-	// it fails: no os.Exit between the open and the return. The
-	// sidecar check is evidence of the close only for scan: report and
-	// trees only read a database that is out of WAL mode, which leaves
-	// nothing on disk whether they close it or not.
+	// it fails: no os.Exit between the open and the return.
 	cases := map[string][]string{
 		cmdScan:   {cmdScan},
 		cmdReport: {cmdReport},
@@ -433,41 +395,3 @@ func TestRunTreesSucceeds(t *testing.T) {
 
 	assertNoSidecars(t, path)
 }
-
-func TestRunReportsNeedOnlyReadAccess(t *testing.T) {
-	// README §Database: report and trees need only read access to the
-	// database file. With its directory read-only as well, SQLite
-	// cannot create any file beside it.
-	path := testDBPath(t)
-	t.Setenv(databaseEnv, path)
-
-	dupes := scanFixture(t)
-	assertNoSidecars(t, path)
-	makeReadOnly(t, path)
-
-	cases := map[string]string{
-		cmdReport: "first\tdupe\tsize\n" +
-			dupes[0] + "\t" + dupes[1] + "\t300\n",
-		cmdTrees: "first\tdupe\tfiles\tsize\n" +
-			filepath.Dir(dupes[0]) + "\t" + filepath.Dir(dupes[1]) +
-			"\t1\t300\n",
-	}
-
-	for name, want := range cases {
-		var stderr bytes.Buffer
-
-		stdout := captureStdout(t)
-
-		code := run([]string{name}, &stderr)
-		if code != exitOK {
-			t.Errorf("run(%s) = %d, want %d; stderr: %s",
-				name, code, exitOK, stderr.String())
-
-			continue
-		}
-
-		if got := stdout(); got != want {
-			t.Errorf("%s stdout = %q, want %q", name, got, want)
-		}
-	}
-}

progress.go

@@ -6,7 +6,6 @@ import (
 	"time"
 
 	"github.com/schollz/progressbar/v3"
-	"golang.org/x/term"
 )
 
 // plainInterval is the minimum time between progress lines when stderr
@@ -25,23 +24,24 @@ const percentScale = 100
 
 // stderrIsTTY reports whether stderr is attached to a terminal.
 func stderrIsTTY() bool {
-	return term.IsTerminal(int(os.Stderr.Fd()))
+	fi, err := os.Stderr.Stat()
+	if err != nil {
+		return false
+	}
+
+	return fi.Mode()&os.ModeCharDevice != 0
 }
 
 // progress renders one scan pass's progress on stderr. On a TTY it
 // delegates to the progressbar library (spinner style when the total is
 // unknown, full bar with count/percent/rate/elapsed/ETA otherwise). When
 // stderr is not a TTY it emits no ANSI redraws: it prints a plain
-// one-line update as the pass starts, then no more often than every
-// plainInterval.
+// one-line update no more often than every plainInterval.
 //
-// All methods must be called from the main goroutine only. On a TTY
-// the library also redraws a spinner from its own goroutine, several
-// times a second, so its count and elapsed time stay current while a
-// pass waits for its next item. A nil *progress is a valid
-// no-display receiver: every method is a no-op, so batched database
-// flushes during the streaming pass can reuse the update-pass helpers
-// without rendering anything.
+// All methods must be called from the main goroutine only. A nil
+// *progress is a valid no-display receiver: every method is a no-op,
+// so batched database flushes during the streaming pass can reuse the
+// update-pass helpers without rendering anything.
 type progress struct {
 	label string
 	total int64 // -1 when unknown (walk pass)
@@ -53,22 +53,10 @@ type progress struct {
 
 func newProgress(label string, total int64) *progress {
 	p := &progress{label: label, total: total, start: time.Now()}
-	if stderrIsTTY() {
-		p.bar = newBar(label, total)
-
+	if !stderrIsTTY() {
 		return p
 	}
 
-	// Print the zero state at once: the first item may take minutes,
-	// and a pass must never look hung.
-	p.last = p.start
-	fmt.Fprintln(os.Stderr, p.plainLine())
-
-	return p
-}
-
-// newBar builds the TTY display for newProgress.
-func newBar(label string, total int64) *progressbar.ProgressBar {
 	opts := []progressbar.Option{
 		progressbar.OptionSetWriter(os.Stderr),
 		progressbar.OptionSetDescription(label),
@@ -93,7 +81,9 @@ func newBar(label string, total int64) *progressbar.ProgressBar {
 		)
 	}
 
-	return progressbar.NewOptions64(total, opts...)
+	p.bar = progressbar.NewOptions64(total, opts...)
+
+	return p
 }
 
 // increment records one completed item and refreshes the display.
@@ -123,22 +113,11 @@ func (p *progress) warnf(format string, args ...any) {
 		return
 	}
 
-	msg := escapePath(fmt.Sprintf(format, args...))
-
-	if p.bar != nil && p.total < 0 {
-		// The library also redraws a spinner from its own goroutine, so
-		// a direct write could land inside a redraw. The bar prints the
-		// warning itself, just before its next redraw.
-		_, _ = progressbar.Bprintln(p.bar, msg)
-
-		return
-	}
-
 	if p.bar != nil {
 		_ = p.bar.Clear()
 	}
 
-	fmt.Fprintln(os.Stderr, msg)
+	fmt.Fprintln(os.Stderr, escapePath(fmt.Sprintf(format, args...)))
 }
 
 // finish terminates the pass's display.

progress_test.go

@@ -1,186 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-)
-
-// spinnerIdle comfortably outlasts the 100ms interval at which the
-// progressbar library redraws a spinner from its own goroutine.
-const spinnerIdle = 500 * time.Millisecond
-
-// captureStderr points os.Stderr at a file for the rest of the test and
-// returns a function reading back everything written to it.
-func captureStderr(t *testing.T) func() string {
-	t.Helper()
-
-	path := filepath.Join(t.TempDir(), "stderr")
-
-	f, err := os.Create(path) //nolint:gosec // test-controlled path
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	saved := os.Stderr
-	os.Stderr = f
-
-	t.Cleanup(func() {
-		os.Stderr = saved
-
-		_ = f.Close()
-	})
-
-	return func() string {
-		b, err := os.ReadFile(path) //nolint:gosec // test-controlled path
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		return string(b)
-	}
-}
-
-//nolint:paralleltest // replaces the process-wide os.Stderr
-func TestStderrIsTTYFalseForNonTerminals(t *testing.T) {
-	r, pipe, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	regular, err := os.Create(filepath.Join(t.TempDir(), "stderr"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	devNull, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	saved := os.Stderr
-
-	t.Cleanup(func() {
-		os.Stderr = saved
-
-		for _, f := range []*os.File{r, pipe, regular, devNull} {
-			_ = f.Close()
-		}
-	})
-
-	cases := map[string]*os.File{
-		"a pipe":         pipe,
-		"a regular file": regular,
-		os.DevNull:       devNull,
-	}
-
-	for name, f := range cases {
-		os.Stderr = f
-
-		if stderrIsTTY() {
-			t.Errorf("stderrIsTTY() = true with stderr on %s", name)
-		}
-	}
-}
-
-// TestNewProgressPrintsBeforeFirstItem checks that each pass shows its
-// zero state the moment it starts when stderr is not a terminal, and
-// that the next line still waits for plainInterval.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestNewProgressPrintsBeforeFirstItem(t *testing.T) {
-	stderr := captureStderr(t)
-
-	newProgress("walk", -1).increment()
-	newProgress("hash", 10).increment()
-
-	want := "walk: 0 files, elapsed 0s\n" +
-		"hash: [0/10] 0% 0 files/s elapsed 0s eta ?\n"
-	if got := stderr(); got != want {
-		t.Errorf("stderr = %q, want %q", got, want)
-	}
-}
-
-// newWalkSpinner returns the walk pass's terminal display, writing to
-// os.Stderr whether or not it is a terminal, and stops the library's
-// redraws when the test ends.
-func newWalkSpinner(t *testing.T) *progress {
-	t.Helper()
-
-	p := &progress{
-		label: "walk", total: -1, start: time.Now(),
-		bar: newBar("walk", -1),
-	}
-	t.Cleanup(p.finish)
-
-	return p
-}
-
-// TestProgressWarningsOnOwnLines drives the terminal display of the walk
-// pass: every warning must land on a line of its own, never inside a
-// redraw of the spinner.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestProgressWarningsOnOwnLines(t *testing.T) {
-	stderr := captureStderr(t)
-	p := newWalkSpinner(t)
-
-	for _, w := range []string{"first", "second", "third"} {
-		p.increment()
-		p.warnf("warning %s", w)
-	}
-
-	p.increment()
-
-	// The spinner prints the warnings at its next redraw.
-	time.Sleep(spinnerIdle)
-
-	// A terminal shows each line as the text after its last carriage
-	// return.
-	var warnings []string
-
-	for line := range strings.SplitSeq(stderr(), "\n") {
-		if strings.Contains(line, "warning") {
-			warnings = append(warnings, line[strings.LastIndex(line, "\r")+1:])
-		}
-	}
-
-	want := []string{"warning first", "warning second", "warning third"}
-	if !slices.Equal(warnings, want) {
-		t.Errorf("warning lines = %q, want %q", warnings, want)
-	}
-}
-
-// TestSpinnerShowsCountAfterBurst checks that once a burst of items
-// faster than the redraw limit is over, the walk display shows every
-// item completed while it waits for the next one.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestSpinnerShowsCountAfterBurst(t *testing.T) {
-	stderr := captureStderr(t)
-	p := newWalkSpinner(t)
-
-	for range 50 {
-		p.increment()
-	}
-
-	time.Sleep(spinnerIdle)
-
-	// A terminal shows the last frame drawn. The library starts each
-	// frame with a carriage return and erases the previous one with
-	// spaces first.
-	var shown string
-
-	for frame := range strings.SplitSeq(stderr(), "\r") {
-		if strings.TrimSpace(frame) != "" {
-			shown = frame
-		}
-	}
-
-	if !strings.Contains(shown, "(50/-,") {
-		t.Errorf("terminal shows %q, want a count of 50", shown)
-	}
-}

report.go

@@ -31,9 +31,9 @@ type scanRec struct {
 // loadRecords opens the database and reads every file record for the
 // report and trees subcommands. Any database problem — including a
 // missing database — is fatal. The error is returned rather than
-// exiting, so that the deferred close always runs; the database is
-// closed before the caller formats its output, so it stays closed even
-// if that output fails.
+// exiting, so that the deferred close — which checkpoints the SQLite
+// WAL — always runs; the database is closed before the caller formats
+// its output, so it stays closed even if that output fails.
 func loadRecords(ctx context.Context) ([]scanRec, error) {
 	dbPath := databasePath()
 

scan.go

@@ -87,9 +87,8 @@ type fileMeta struct {
 // hash only when its size, head, and tail match another file's. Flag
 // parsing and the at-least-one-operand check are done by cobra. Errors
 // are returned rather than exiting, so that the deferred close — which
-// takes the database out of WAL mode — always runs. Cancelling ctx
-// unwinds the worker pools and aborts the scan with the context's
-// error.
+// checkpoints the SQLite WAL — always runs. Cancelling ctx unwinds the
+// worker pools and aborts the scan with the context's error.
 func runScan(ctx context.Context, roots []string, workers int,
 	oneFS bool,
 ) error {
@@ -109,7 +108,7 @@ func runScan(ctx context.Context, roots []string, workers int,
 		return err
 	}
 
-	defer closeScanDatabase(ctx, db, dbPath)
+	defer func() { _ = db.Close() }()
 
 	st, err := syncScan(ctx, db, roots, workers, oneFS)
 	if err != nil {