fix: stop a clean close from disabling the retirement compensation wait

Retirement compensation decides whether to wait for the restored managed route
by asking whether anything went wrong, and it asked with len(restoreErrors)==0.
Appending still grows a slice when the value is nil, and two of the appends
were unconditional: deletionLock.Close() and errors.Join of an open error with
a resolver close. Closing cleanly therefore made the check false every time, so
waitForMountAcknowledgement and the route verification behind it never ran —
rollback returned the moment it had rewritten the state, before the route it
had just restored was readable again.

errors.Is on the returned error could not see this: the rejection is joined
with the restore errors, and it matches on the rejection alone. The only test
that observed it read a channel the restoring goroutine had not necessarily
reached yet, so the failure was a platform-dependent coin flip rather than the
certainty it actually was.

Record only real failures. A unit test pins the accounting, since that is the
part that silently decided the behaviour.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jstar0

internal/cli/fs.go

@@ -2044,14 +2044,24 @@ func newFSRollbackCommand() *cobra.Command {
 					}
 					restoreManagedRoute := func(cause error, retiredState string, retiredSnapshot string) error {
 						var restoreErrors []error
+						// Only a real failure may be recorded. `len(restoreErrors) == 0`
+						// is what decides whether this compensation goes on to wait for
+						// the restored route, and appending a nil still grows the slice:
+						// closing the lock cleanly used to make that check false every
+						// time, so the wait and the verification below never ran.
+						recordRestoreError := func(errs ...error) {
+							if joined := errors.Join(errs...); joined != nil {
+								restoreErrors = append(restoreErrors, joined)
+							}
+						}
 						deletionLock, lockErr := storage.AcquireOperationLock(store, "session-deletions")
 						if lockErr != nil {
 							return errors.Join(cause, fmt.Errorf("serialize retirement compensation with explicit deletion: %w", lockErr))
 						}
 						lockOpen := true
 						closeDeletionLock := func() {
 							if lockOpen {
-								restoreErrors = append(restoreErrors, deletionLock.Close())
+								recordRestoreError(deletionLock.Close())
 								lockOpen = false
 							}
 						}
@@ -2105,7 +2115,7 @@ func newFSRollbackCommand() *cobra.Command {
 							} else {
 								restored = restoredManaged.State()
 								restoredVisible, openErr = hashManagedSessionVisible(command.Context(), restoredManaged)
-								restoreErrors = append(restoreErrors, errors.Join(openErr, restoredResolver.Close()))
+								recordRestoreError(openErr, restoredResolver.Close())
 								if err := upsertManagedSessionRegistryEntryIfPresent(store, restored.SessionID, restored.Generation); err != nil {
 									restoreErrors = append(restoreErrors, err)
 								}

internal/cli/fs_test.go

@@ -5241,3 +5241,32 @@ func TestEnrollmentPlanSizesAnAutomaticBatchFromMeasuredCost(t *testing.T) {
 		t.Fatalf("manual batch selected %d sessions, want exactly 3", len(manual.Selected))
 	}
 }
+
+func TestRestoreErrorAccountingIgnoresCleanCloses(t *testing.T) {
+	// This mirrors how the retirement compensation accumulates failures. It
+	// decides whether to wait for the restored route by asking whether anything
+	// went wrong, and a nil appended by a clean close answered that question
+	// wrongly: the wait and the verification behind it became unreachable.
+	var restoreErrors []error
+	record := func(errs ...error) {
+		if joined := errors.Join(errs...); joined != nil {
+			restoreErrors = append(restoreErrors, joined)
+		}
+	}
+
+	var cleanClose error
+	record(cleanClose)
+	record(nil, nil)
+	if len(restoreErrors) != 0 {
+		t.Fatalf("a clean close counted as a failure: %v", restoreErrors)
+	}
+
+	record(errors.New("boom"))
+	if len(restoreErrors) != 1 {
+		t.Fatalf("a real failure was not recorded: %v", restoreErrors)
+	}
+	record(nil, errors.New("second"))
+	if len(restoreErrors) != 2 {
+		t.Fatalf("a failure joined with a nil was not recorded: %v", restoreErrors)
+	}
+}