Problem
101+ backend test sites (internal/services, auth_handler_test.go, and others) construct an in-memory SQLite DSN keyed only by t.Name() with a shared cache (file::memory:?cache=shared style DSN, or equivalent). Under -race -count=N (N>1) combined with t.Parallel(), tests with the same name across packages/subtests can collide on the same in-memory DB, producing UNIQUE constraint failed errors and nil-pointer panics.
How this was found
Surfaced as a side effect while stress-testing the fix for the nightly SQLite unlinkat/directory not empty flake (development commits 5e38d2c5..b9a46963). QA-security proved this class is pre-existing and unrelated to that fix by reproducing the identical failures against the pre-fix baseline commit 62107fc0.
Current impact
Not currently causing nightly/CI failures — standard CI runs tests at -count=1, which doesn't trigger the collision. This is a latent risk: it will start causing flaky failures the moment anyone runs stress tests (-count=N for N>1) or expands t.Parallel() usage in these packages.
Suggested fix
Key the in-memory DSN by something guaranteed-unique per test run (e.g. t.Name() + a random suffix, or a monotonic counter), consistent with how t.TempDir()-backed tests already get unique paths per invocation.
Priority
Medium — not urgent (doesn't affect current CI), but worth fixing before any future push toward -count=N stress testing or heavier t.Parallel() adoption in the backend suite. ~101 sites is a large sweep; scope it as its own dedicated task rather than folding into an unrelated PR.
Problem
101+ backend test sites (
internal/services,auth_handler_test.go, and others) construct an in-memory SQLite DSN keyed only byt.Name()with a shared cache (file::memory:?cache=sharedstyle DSN, or equivalent). Under-race -count=N(N>1) combined witht.Parallel(), tests with the same name across packages/subtests can collide on the same in-memory DB, producingUNIQUE constraint failederrors and nil-pointer panics.How this was found
Surfaced as a side effect while stress-testing the fix for the nightly SQLite
unlinkat/directory not emptyflake (developmentcommits5e38d2c5..b9a46963). QA-security proved this class is pre-existing and unrelated to that fix by reproducing the identical failures against the pre-fix baseline commit62107fc0.Current impact
Not currently causing nightly/CI failures — standard CI runs tests at
-count=1, which doesn't trigger the collision. This is a latent risk: it will start causing flaky failures the moment anyone runs stress tests (-count=Nfor N>1) or expandst.Parallel()usage in these packages.Suggested fix
Key the in-memory DSN by something guaranteed-unique per test run (e.g.
t.Name()+ a random suffix, or a monotonic counter), consistent with howt.TempDir()-backed tests already get unique paths per invocation.Priority
Medium — not urgent (doesn't affect current CI), but worth fixing before any future push toward
-count=Nstress testing or heaviert.Parallel()adoption in the backend suite. ~101 sites is a large sweep; scope it as its own dedicated task rather than folding into an unrelated PR.