fix(server): stop the background compaction before the database is closed

The compaction starts right away in NewServer and could still write to the SQLite files while a
test's temp dir was removed ("directory not empty" on the CI runner, TestWebhookTokenInURLOnlyAPIKey).
Server.Close stops it and waits for a running pass; tests call it before closing the store, and the
server calls it on shutdown before the deferred store.Close. v0.37.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/demo_test.go

@@ -26,6 +26,7 @@ func TestDemoResetKeepsSessionsAndRestoresSampleData(t *testing.T) {
 		t.Fatal(err)
 	}
 	srv := NewServer(&config.Config{DatabasePath: dbPath, JWTSecret: "demo-secret", DemoMode: true}, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 	call := func(method, path, token, body string) *httptest.ResponseRecorder {
 		req := httptest.NewRequest(method, path, strings.NewReader(body))

internal/api/docsync.go

@@ -266,9 +266,14 @@ func (s *Server) handleDocLeave(w http.ResponseWriter, r *http.Request) {
 const compactionInterval = 6 * time.Hour
 
 func (s *Server) startCompaction() {
+	defer s.bg.Done()
 	for {
 		s.compactOnce()
-		time.Sleep(compactionInterval)
+		select {
+		case <-s.stop:
+			return
+		case <-time.After(compactionInterval):
+		}
 	}
 }
 

internal/api/s4_test.go

@@ -24,6 +24,7 @@ func TestDemoSendsNothingAndKeepsAccounts(t *testing.T) {
 		t.Fatal(err)
 	}
 	srv := NewServer(&config.Config{DatabasePath: dbPath, JWTSecret: "demo-secret", DemoMode: true}, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 	token := sessionLogin(t, router, "admin", "admin", "visitor-1")
 	_ = sessionLogin(t, router, "admin", "admin", "visitor-2")

internal/api/server.go

@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -41,6 +42,11 @@ type Server struct {
 	notifyPushHook    func(userID string, msg pushMessage) error
 	pushHTTPClient    *http.Client // tests: reach a local push service
 	push              pushKeys
+
+	// Background work that touches the database right from the start (compaction); Close stops it
+	stop     chan struct{}
+	stopOnce sync.Once
+	bg       sync.WaitGroup
 }
 
 func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS fs.FS) *Server {
@@ -51,6 +57,7 @@ func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS
 		staticFS: staticFS,
 		leases:   collab.NewLeaseManager(nil),
 		notifier: collab.NewNotifier(),
+		stop:     make(chan struct{}),
 	}
 	srv.loginGuard = newLoginGuard(!cfg.DisableLoginProtection)
 	srv.voice = newVoiceService(cfg.Speech.MaxParallel)
@@ -63,6 +70,7 @@ func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS
 	store.OnTaskCreated = func(th *domain.Thought) {
 		srv.wsHub.BroadcastToUsers(srv.taskAudience(th), "TASK_CREATED", th)
 	}
+	srv.bg.Add(1)
 	go srv.startCompaction()
 	if cfg.DemoMode && cfg.DemoResetMinutes > 0 {
 		go srv.startDemoResetTicker()
@@ -93,6 +101,13 @@ func (s *Server) taskAudience(th *domain.Thought) []string {
 	return append(s.store.GetTaskListUserIDs(th.TaskListID), th.UserID)
 }
 
+// Close stops the background compaction and waits until a running pass has finished, so the database
+// can be closed safely afterwards (tests close it right away; a pass still writing would race with that).
+func (s *Server) Close() {
+	s.stopOnce.Do(func() { close(s.stop) })
+	s.bg.Wait()
+}
+
 func (s *Server) Router() http.Handler {
 	r := chi.NewRouter()
 

internal/api/server_test.go

@@ -46,6 +46,7 @@ func setupTestServer(t *testing.T) (*Server, *storage.Store, string) {
 	}
 	hub := ws.NewHub()
 	srv := NewServer(cfg, store, hub, nil)
+	t.Cleanup(srv.Close)
 
 	token, err := auth.GenerateToken(cfg.JWTSecret, user.ID, user.Email, user.DisplayName, user.TokenVersion, testSession(t, store, user.ID))
 	if err != nil {
@@ -71,6 +72,7 @@ func TestFirstBootSetupAndInviteRegistrationAndNonNullSlices(t *testing.T) {
 		AllowRegistration: false,
 	}
 	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 
 	// 1. Fresh DB must report needsSetup = true
@@ -455,6 +457,7 @@ func TestLoginWithUsernameAndDemoMode(t *testing.T) {
 		DemoMode:     true,
 	}
 	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 
 	// 1. Check auth status reports demoMode: true
@@ -542,6 +545,7 @@ func TestSpaceMembersDirectInvitationAPI(t *testing.T) {
 		JWTSecret:    "test-secret",
 	}
 	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 
 	adminUser, err := store.GetUserByLogin("admin")
@@ -771,6 +775,7 @@ func TestWebhookTriageBadgeAndIngestion(t *testing.T) {
 		AllowRegistration: false,
 	}
 	srv := NewServer(cfg, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 
 	// 1. Setup user
@@ -864,6 +869,7 @@ func TestSSEGlobalEndpoint(t *testing.T) {
 		AllowRegistration: false,
 	}
 	srv := NewServer(cfg, store, hub, nil)
+	t.Cleanup(srv.Close)
 	router := srv.Router()
 
 	setupBody := []byte(`{
@@ -1345,6 +1351,7 @@ func TestFirstBootSetupWithSampleData(t *testing.T) {
 	}
 	defer store.Close()
 	srv := NewServer(&config.Config{Port: "8080", DatabasePath: dbPath, JWTSecret: "test-jwt-secret-key"}, store, ws.NewHub(), nil)
+	t.Cleanup(srv.Close)
 
 	// Too short passwords are refused (FLAW-09)
 	short := httptest.NewRequest(http.MethodPost, "/api/v1/auth/setup", strings.NewReader(`{"email":"me@example.com","password":"secret"}`))