fix: make server operations executable

tools/thothctl/internal/config/installation_test.go

@@ -78,6 +78,76 @@ func TestComposeArgsAutomaticallyIncludeTheInstallationCurrentImageOverride(t *t
 	}
 }
 
+func TestComposeArgsWithFinalOverridePreservesCurrentImagePrecedence(t *testing.T) {
+	installationPath, _, _, _ := writeInstallation(t, "server")
+	seed, err := Load(installationPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(seed.ControlDirectory(), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(seed.CurrentImageOverridePath(), []byte("services: {}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	final := filepath.Join(seed.ControlDirectory(), "migration.yaml")
+	if err := os.WriteFile(final, []byte("services: {}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	installation, err := Load(installationPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	args, err := installation.ComposeArgsWithFinalOverride(final, "--profile", "session-migrate", "config")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"-f", installation.CurrentImageOverridePath(), "-f", final, "--profile", "session-migrate", "config"}
+	if !containsSequence(args, want) {
+		t.Fatalf("ComposeArgsWithFinalOverride() = %#v, want %#v", args, want)
+	}
+}
+
+func TestPreservationPathsReturnsCanonicalBindRootsBackupsAndSecretFiles(t *testing.T) {
+	installationPath, _, envFile, _ := writeInstallation(t, "server")
+	root := filepath.Dir(envFile)
+	var wanted []string
+	var lines []string
+	for _, item := range []struct{ key, name string }{
+		{"THT_DATA_ROOT", "data"},
+		{"THT_PI_STATE_ROOT", "pi-state"},
+		{"THT_WORKSPACE_REGISTRY_ROOT", "workspace-registry"},
+		{"THT_BACKUP_ROOT", "backups"},
+	} {
+		path := filepath.Join(root, item.name)
+		if err := os.Mkdir(path, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		wanted = append(wanted, path)
+		lines = append(lines, item.key+"="+path)
+	}
+	secret := filepath.Join(root, "secret")
+	if err := os.WriteFile(secret, []byte("secret"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	wanted = append(wanted, secret)
+	lines = append(lines, "APP_TOKEN_FILE="+secret)
+	if err := os.WriteFile(envFile, []byte(strings.Join(lines, "\n")+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	installation, err := Load(installationPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := installation.PreservationPaths()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertStringsEqual(t, got, wanted)
+}
+
 func TestInstallationControlPathsAreIsolatedForDescriptorsSharingOneCheckout(t *testing.T) {
 	projectDirectory := t.TempDir()
 	first := Installation{Path: filepath.Join(t.TempDir(), installationFileName), ProjectDirectory: projectDirectory}