)

Dropping an ActiveInterruptibleTransaction without commit/rollback left
the write connection in the pool with an open transaction. sqlx pools
reuse connections rather than closing them, so SQLite's close-time
auto-rollback never fired, and the next acquire_writer() got a
connection where BEGIN IMMEDIATE failed with "cannot start a
transaction within a transaction".

Drop now takes the writer and spawns a tokio task that issues ROLLBACK
(and detach_if_attached) before the connection is released to the pool.
The rollback task is bounded by a 5 s timeout so a stuck ROLLBACK
cannot hold the single-writer permit indefinitely. To eliminate a panic
risk at Drop time on threads without a tokio thread-local (notably
Tauri teardown after a programmatic app_handle.exit(N) on the main
thread), ActiveInterruptibleTransaction captures a tokio runtime handle
at construction and uses it unconditionally in Drop. The
insert()/remove()/abort_all() paths that previously relied on Drop now
roll back explicitly.

As defense-in-depth against any other writer path that might leak a
transaction (e.g. user code that does BEGIN and returns early), the
write pool gets an after_release hook that runs ROLLBACK. The hook
treats "no transaction is active" as the expected benign case and
instructs the pool to discard the connection on any other ROLLBACK
failure, so a broken connection is not handed to the next caller.

The plugin's ExitRequested handler no longer short-circuits on
programmatic exits (Some(code)). Treating those the same as
user-initiated exits means a user-space app_handle.exit(N) — fatal-
error handler, auto-updater, Ctrl+C handler — triggers transaction and
database cleanup instead of tearing down plugin state with live
interruptible transactions still in the map. The original exit code is
preserved through the cleanup detour via ExitGuard. CLEANUP_STATE == 2
is used to recognize the ExitGuard-driven re-exit and let it through.

Adds a regression test that mirrors the reporter's MCVE plus a second
test covering the attached-database drop path. Both wrap the second
begin_interruptible_transaction in tokio::time::timeout so a regression
in the drop path fails CI fast instead of hanging.

Updates the README to document the auto-rollback-on-drop guarantee
(including early returns via ?).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>