fix: close Pi management final review findings

tools/thothctl/internal/pi/restart_test.go

@@ -55,15 +55,51 @@ func TestRestartDrainsRecreatesOnlyCoreAndRetainsImage(t *testing.T) {
 	if sleepCalls != 1 {
 		t.Fatalf("drain sleep calls = %d, want 1", sleepCalls)
 	}
-	assertCalled(t, fake.calls, "up --detach --wait --wait-timeout 45 --no-deps --force-recreate core")
-	assertNotCalled(t, fake.calls, "build --pull")
-	assertNotCalled(t, fake.calls, "pull ")
+	assertCalled(t, fake.calls, "up --detach --wait --wait-timeout 45 --no-deps --force-recreate --no-build --pull never core")
+	assertNotCalled(t, fake.calls, "compose build --pull")
+	for _, call := range fake.calls {
+		if strings.HasPrefix(call, "pull ") {
+			t.Fatalf("restart invoked direct image pull: %s", call)
+		}
+	}
 	assertNotCalled(t, fake.calls, "frontend")
 	if _, err := os.Stat(result.StatePath); !errors.Is(err, os.ErrNotExist) {
 		t.Fatalf("successful restart state still exists: %v", err)
 	}
 }
 
+func TestRestartPinsCapturedImageWhenConfiguredTagMovesBeforeRecreate(t *testing.T) {
+	dir := t.TempDir()
+	fake := newFakeRunner()
+	hooks := defaultLifecycleHooks
+	write := hooks.writeState
+	hooks.writeState = func(path string, state State) error {
+		if state.Phase == PhasePreflight && state.MutationStarted {
+			fake.tags[fake.configuredImage] = "sha256:moved-configured-tag"
+			fake.imageVersions["sha256:moved-configured-tag"] = "9.99.0"
+		}
+		return write(path, state)
+	}
+	restartStatePath := filepath.Join(dir, "restart-state.json")
+
+	result, err := restartWithHooks(context.Background(), fake, RestartRequest{
+		StatePath:       restartStatePath,
+		UpdateStatePath: filepath.Join(dir, "update-state.json"),
+		Confirm:         true,
+	}, hooks)
+	if err != nil {
+		t.Fatalf("restartWithHooks() error = %v", err)
+	}
+	if result.Version != "0.80.3" || fake.currentImage != "sha256:old" {
+		t.Fatalf("restart result=%+v image=%q; want captured 0.80.3 / sha256:old", result, fake.currentImage)
+	}
+	assertCalled(t, fake.calls, "image tag sha256:old thothii-core:thothctl-")
+	assertCalled(t, fake.calls, "pi-lifecycle-")
+	if matches, globErr := filepath.Glob(filepath.Join(dir, "pi-lifecycle-*.yaml")); globErr != nil || len(matches) != 0 {
+		t.Fatalf("successful restart overrides = %v, error = %v; want safe cleanup", matches, globErr)
+	}
+}
+
 func TestRestartRefusesActiveSessionsWithoutDrain(t *testing.T) {
 	dir := t.TempDir()
 	fake := newFakeRunner()
@@ -193,6 +229,11 @@ func TestRestartPostRecreateFailureKeepsMaintenanceAndRecoveryState(t *testing.T
 	if stateErr != nil || !state.MutationStarted {
 		t.Fatalf("restart recovery state = %+v, %v; want durable mutation state", state, stateErr)
 	}
+	overridePath := lifecycleOverridePath(statePath, state.Transaction)
+	selected, overrideErr := readLifecycleOverride(overridePath)
+	if overrideErr != nil || selected != state.Previous.Reference || fake.tags[selected] != state.Previous.ID {
+		t.Fatalf("restart override = %q, %v; want retained exact image %q", selected, overrideErr, state.Previous.ID)
+	}
 }
 
 func TestRestartMaintenanceClearFailureRestoresRecoveryState(t *testing.T) {
@@ -233,6 +274,16 @@ func TestRecoverLifecycleMaintenanceVerifiesAndClearsRestartState(t *testing.T)
 		Previous:        previous,
 		MutationStarted: true,
 	})
+	restartState, err := readState(restartStatePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	restartOverride := lifecycleOverridePath(restartStatePath, restartState.Transaction)
+	if err := writeLifecycleOverride(restartOverride, restartState.Previous.Reference); err != nil {
+		t.Fatal(err)
+	}
+	delete(fake.tags, restartState.Previous.Reference)
+	fake.tags[fake.configuredImage] = "sha256:moved-before-recovery"
 	candidate := previous
 	candidate.Reference = "thothii-core:thothctl-recover-candidate"
 	writeStateForTest(t, updateStatePath, State{
@@ -254,6 +305,13 @@ func TestRecoverLifecycleMaintenanceVerifiesAndClearsRestartState(t *testing.T)
 	if _, err := os.Stat(restartStatePath); !errors.Is(err, os.ErrNotExist) {
 		t.Fatalf("restart recovery state still exists: %v", err)
 	}
+	if _, err := os.Stat(restartOverride); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("restart recovery override still exists: %v", err)
+	}
+	if fake.tags[restartState.Previous.Reference] != restartState.Previous.ID {
+		t.Fatalf("restart recovery pin = %q, want %q", fake.tags[restartState.Previous.Reference], restartState.Previous.ID)
+	}
+	assertCalled(t, fake.calls, restartOverride)
 	if fake.maintenance {
 		t.Fatal("maintenance remained active after both lifecycle states were verified")
 	}