fix: shutdown admission, recovery identity/order, rollback journal retention, pickup merge

1 files changed, 24 insertions, 1 deletions

diff --git a/internal/persistence/txn_test.go b/internal/persistence/txn_test.go
index 10a809d..796cd56 100644
--- a/internal/persistence/txn_test.go
+++ b/internal/persistence/txn_test.go
@@ -99,8 +99,31 @@ func TestTxnRollbackOnFailure(t *testing.T) {
 	if got := readTestFile(t, filepath.Join(sub, "gone.yaml")); got != "old-gone" {
 		t.Fatalf("rollback did not restore deleted file: %q", got)
 	}
+	// The restore of gone.yaml ran inside the still read-only directory, so
+	// the ROLLBACK itself failed there: the journal is the only durable
+	// record of the pre-transaction state and must be KEPT (deleting it
+	// would make any remaining divergence unrecoverable). See
+	// TestCommitKeepsJournalAfterFailedRollback.
+	if entries, _ := ListJournalFiles(journalDir); len(entries) != 1 {
+		t.Fatalf("journal must be kept after a failed rollback: %v", entries)
+	}
+
+	// Repair the directory permission: the next Recover completes the
+	// rollback and cleans the journal.
+	if err := os.Chmod(sub, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := Recover(journalDir); err != nil {
+		t.Fatalf("recovery retry after repair: %v", err)
+	}
+	if got := readTestFile(t, filepath.Join(dir, "a.yaml")); got != "old-a" {
+		t.Fatalf("recovery retry disturbed a.yaml: %q", got)
+	}
+	if got := readTestFile(t, filepath.Join(sub, "gone.yaml")); got != "old-gone" {
+		t.Fatalf("recovery retry disturbed gone.yaml: %q", got)
+	}
 	if entries, _ := ListJournalFiles(journalDir); len(entries) != 0 {
-		t.Fatalf("journal not cleaned after rollback: %v", entries)
+		t.Fatalf("completed recovery left journals behind: %v", entries)
 	}
 }