From e42952469dadfb3535633c66c881050ac128703c Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Mon, 5 Oct 2026 17:05:14 -0400
Subject: fix: gather verbs, walk oom, admin path bypass, roulette refund

---
 internal/persistence/txn_test.go | 73 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

(limited to 'internal/persistence/txn_test.go')

diff --git a/internal/persistence/txn_test.go b/internal/persistence/txn_test.go
index 796cd56..be19c7c 100644
--- a/internal/persistence/txn_test.go
+++ b/internal/persistence/txn_test.go
@@ -207,3 +207,76 @@ func TestTxnMoveOverwritesDestination(t *testing.T) {
 		t.Fatal("unreachable")
 	}
 }
+
+// Regression: Move followed by Delete/Replace on the same path used to clobber
+// the move record, silently losing the file with a nil Commit error.
+func TestTxnRejectsConflictingMoveThenDelete(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "src.yaml")
+	dst := filepath.Join(dir, "dst.yaml")
+	writeTestFile(t, src, "content")
+	txn := NewTransaction(filepath.Join(dir, ".journal"))
+	if err := txn.Move(src, dst); err != nil {
+		t.Fatal(err)
+	}
+	if err := txn.Delete(src); err == nil {
+		t.Fatal("Delete after Move on the same path was accepted")
+	}
+}
+
+func TestTxnRejectsConflictingMoveThenReplace(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "src.yaml")
+	dst := filepath.Join(dir, "dst.yaml")
+	writeTestFile(t, src, "content")
+	txn := NewTransaction(filepath.Join(dir, ".journal"))
+	if err := txn.Move(src, dst); err != nil {
+		t.Fatal(err)
+	}
+	if err := txn.Replace(src, []byte("new"), 0644); err == nil {
+		t.Fatal("Replace after Move on the same path was accepted")
+	}
+}
+
+// Move then Replace on the destination is the supported pattern and must still
+// work.
+func TestTxnMoveThenReplaceDestination(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "src.yaml")
+	dst := filepath.Join(dir, "dst.yaml")
+	writeTestFile(t, src, "content")
+	txn := NewTransaction(filepath.Join(dir, ".journal"))
+	if err := txn.Move(src, dst); err != nil {
+		t.Fatal(err)
+	}
+	if err := txn.Replace(dst, []byte("rewritten"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := txn.Commit(); err != nil {
+		t.Fatal(err)
+	}
+	if got := readTestFile(t, dst); got != "rewritten" {
+		t.Fatalf("dst = %q, want rewritten", got)
+	}
+}
+
+// Regression: an unrecognised op kind must abort recovery and keep the journal
+// rather than silently dropping the before-image and deleting the record.
+func TestRecoverKeepsJournalWithUnknownOpKind(t *testing.T) {
+	dir := t.TempDir()
+	journalDir := filepath.Join(dir, ".journal")
+	if err := os.MkdirAll(journalDir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	journal := []byte(`{"ops":[{"path":"` + filepath.Join(dir, "a.yaml") + `","kind":"future-kind","old_exists":false}]}`)
+	path := filepath.Join(journalDir, "txn-unknown.json")
+	if err := os.WriteFile(path, journal, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := Recover(journalDir); err == nil {
+		t.Fatal("Recover accepted an unknown op kind")
+	}
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("journal with unknown kind was removed: %v", err)
+	}
+}
-- 
cgit v1.2.3