1 files changed, 33 insertions, 0 deletions
diff --git a/internal/admin/correct_audit_fixes_test.go b/internal/admin/correct_audit_fixes_test.go
index d7b713e..282e943 100644
--- a/internal/admin/correct_audit_fixes_test.go
+++ b/internal/admin/correct_audit_fixes_test.go
@@ -89,3 +89,36 @@ func TestResolveDataPathRejectsSymlinkEscape(t *testing.T) {
 		t.Fatalf("normal path rejected: %v", err)
 	}
 }
+
+// Regression: an intentionally empty before-image must be restorable after a
+// restart. The existence flag distinguishes it from a missing (failed-read)
+// image, which both persist as "".
+func TestUndoRestoresIntentionallyEmptyFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "rooms", "1.yaml")
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("id: 1\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	us := NewUndoStack(dir)
+	us.Push(ChangeDesc{
+		Description: "write to an originally empty file",
+		FilePath:    path,
+		OldContent:  []byte{}, // exists, but empty
+		NewContent:  []byte("id: 1\n"),
+	})
+	// Reload from disk to exercise the persistence round trip.
+	us2 := NewUndoStack(dir)
+	if ch := us2.Undo(); ch == nil {
+		t.Fatalf("undo of an empty-but-existing before-image was refused: %v", us2.LastError())
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(data) != 0 {
+		t.Fatalf("file not restored to empty: %q", data)
+	}
+}