Refuse orphan state without Domain Store authority

crates/lazaret-client/tests/state_cli.rs

@@ -42,6 +42,52 @@ fn reset_refuses_an_arbitrary_container_or_host_path_before_state_access() {
     );
 }
 
+#[allow(clippy::disallowed_methods, clippy::disallowed_types)]
+#[test]
+fn missing_store_succeeds_only_when_the_complete_state_anchor_is_absent() {
+    let fixture = Fixture::new();
+    for operation in ["list", "inspect", "verify", "reset"] {
+        let mut command = fixture.command(operation);
+        if operation == "reset" {
+            command.args(["--all", "--yes"]);
+        }
+        let absent = command.arg("--json").output().unwrap();
+        assert!(
+            absent.status.success(),
+            "{operation}: {}",
+            String::from_utf8_lossy(&absent.stderr)
+        );
+    }
+
+    let domain = fixture.domain_root();
+    assert!(!domain.join("domain.redb").exists());
+    fs::create_dir_all(domain.join("state-anchor/reset-quarantine")).unwrap();
+    fs::create_dir_all(domain.join("state-anchor/upper/usr")).unwrap();
+    fs::write(domain.join("state-anchor/upper/usr/value"), b"persisted").unwrap();
+
+    for operation in ["list", "inspect", "verify", "reset"] {
+        let mut command = fixture.command(operation);
+        if operation == "reset" {
+            command.args(["--all", "--yes"]);
+        }
+        let output = command.output().unwrap();
+        assert!(
+            !output.status.success(),
+            "{operation} accepted orphan state"
+        );
+        assert!(
+            String::from_utf8_lossy(&output.stderr)
+                .contains("State Anchor exists without Domain Store authority")
+        );
+        assert_eq!(
+            fs::read(domain.join("state-anchor/upper/usr/value")).unwrap(),
+            b"persisted"
+        );
+        assert!(domain.join("state-anchor/reset-quarantine").is_dir());
+        assert!(!domain.join("domain.redb").exists());
+    }
+}
+
 struct Fixture {
     root: tempfile::TempDir,
 }
@@ -77,4 +123,11 @@ impl Fixture {
             .env("XDG_RUNTIME_DIR", self.root.path().join("runtime"));
         command
     }
+
+    fn domain_root(&self) -> std::path::PathBuf {
+        let mut domains = fs::read_dir(self.root.path().join("data/domains")).unwrap();
+        let domain = domains.next().unwrap().unwrap().path();
+        assert!(domains.next().is_none());
+        domain
+    }
 }