Harden local runtime safety and error handling

internal/appstate/backup_test.go

@@ -1,11 +1,15 @@
 package appstate
 
 import (
+	"archive/zip"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
 )
 
 func TestEnsureRotatingLocalBackupCreatesAndRotates(t *testing.T) {
@@ -13,8 +17,8 @@ func TestEnsureRotatingLocalBackupCreatesAndRotates(t *testing.T) {
 	dbPath := filepath.Join(temp, "qfs.db")
 	cfgPath := filepath.Join(temp, "config.yaml")
 
-	if err := os.WriteFile(dbPath, []byte("db"), 0644); err != nil {
-		t.Fatalf("write db: %v", err)
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
 	}
 	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
 		t.Fatalf("write config: %v", err)
@@ -36,6 +40,7 @@ func TestEnsureRotatingLocalBackupCreatesAndRotates(t *testing.T) {
 	if _, err := os.Stat(dailyArchive); err != nil {
 		t.Fatalf("daily archive missing: %v", err)
 	}
+	assertZipContains(t, dailyArchive, "qfs.db", "config.yaml")
 
 	backupNow = func() time.Time { return time.Date(2026, 2, 12, 10, 0, 0, 0, time.UTC) }
 	created, err = EnsureRotatingLocalBackup(dbPath, cfgPath)
@@ -57,8 +62,8 @@ func TestEnsureRotatingLocalBackupEnvControls(t *testing.T) {
 	dbPath := filepath.Join(temp, "qfs.db")
 	cfgPath := filepath.Join(temp, "config.yaml")
 
-	if err := os.WriteFile(dbPath, []byte("db"), 0644); err != nil {
-		t.Fatalf("write db: %v", err)
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
 	}
 	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
 		t.Fatalf("write config: %v", err)
@@ -95,8 +100,8 @@ func TestEnsureRotatingLocalBackupRejectsGitWorktree(t *testing.T) {
 	if err := os.MkdirAll(filepath.Dir(dbPath), 0755); err != nil {
 		t.Fatalf("mkdir data dir: %v", err)
 	}
-	if err := os.WriteFile(dbPath, []byte("db"), 0644); err != nil {
-		t.Fatalf("write db: %v", err)
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
 	}
 	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
 		t.Fatalf("write cfg: %v", err)
@@ -110,3 +115,43 @@ func TestEnsureRotatingLocalBackupRejectsGitWorktree(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 }
+
+func writeTestSQLiteDB(path string) error {
+	db, err := gorm.Open(sqlite.Open(path), &gorm.Config{})
+	if err != nil {
+		return err
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		return err
+	}
+	defer sqlDB.Close()
+
+	return db.Exec(`
+		CREATE TABLE sample_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			name TEXT NOT NULL
+		);
+		INSERT INTO sample_items(name) VALUES ('backup');
+	`).Error
+}
+
+func assertZipContains(t *testing.T, archivePath string, expected ...string) {
+	t.Helper()
+
+	reader, err := zip.OpenReader(archivePath)
+	if err != nil {
+		t.Fatalf("open archive: %v", err)
+	}
+	defer reader.Close()
+
+	found := make(map[string]bool, len(reader.File))
+	for _, file := range reader.File {
+		found[file.Name] = true
+	}
+	for _, name := range expected {
+		if !found[name] {
+			t.Fatalf("archive %s missing %s", archivePath, name)
+		}
+	}
+}