test: cover disk_in_use and network_available failure paths

These two boundary functions backed the pre-flight guards from #215 but had no unit coverage of their own. The VM harness exercised them instead. I added 7 bats tests that mock the system commands they query, so the real branching logic runs.

test_disk.bats covers disk_in_use across mountpoint, active swap, imported-zpool member, and idle — that's the gate that refuses to wipe an already-mounted disk. test_archangel.bats covers network_available for DNS failure, TCP-connect failure, and success, the check that fails the install before pacstrap. The /proc/mdstat-positive branch and the live probes stay in the VM harness, since neither drives cleanly without writing to /proc or hitting the network. Suite 238 to 245, lint clean.

2 files changed, 74 insertions, 0 deletions

diff --git a/tests/unit/test_archangel.bats b/tests/unit/test_archangel.bats
index c38dcb8..645b6e6 100644
--- a/tests/unit/test_archangel.bats
+++ b/tests/unit/test_archangel.bats
@@ -372,3 +372,32 @@ setup() {
     run validate_install_targets
     [ "$status" -eq 0 ]
 }
+
+#############################
+# network_available
+#############################
+# The two probes it composes — DNS via getent and a TCP-443 open via
+# timeout+bash /dev/tcp — are the system boundary; mocking them drives the
+# fail-fast wiring without a live network. The real probe runs in the VM
+# harness. These pin the "network failure before pacstrap" error path that
+# validate_install_targets surfaces.
+
+@test "network_available returns 1 when DNS resolution fails" {
+    getent() { return 1; }
+    run network_available
+    [ "$status" -eq 1 ]
+}
+
+@test "network_available returns 1 when DNS resolves but the TCP connect fails" {
+    getent() { return 0; }
+    timeout() { return 1; }
+    run network_available
+    [ "$status" -eq 1 ]
+}
+
+@test "network_available returns 0 when DNS resolves and the TCP connect opens" {
+    getent() { return 0; }
+    timeout() { return 0; }
+    run network_available
+    [ "$status" -eq 0 ]
+}
diff --git a/tests/unit/test_disk.bats b/tests/unit/test_disk.bats
index 6bc6d8d..b962445 100644
--- a/tests/unit/test_disk.bats
+++ b/tests/unit/test_disk.bats
@@ -275,3 +275,48 @@ partition_disks_setup() {
     run disk_meets_min_size ""
     [ "$status" -eq 1 ]
 }
+
+# disk_in_use
+#
+# The safety gate validate_install_targets leans on to refuse wiping a disk
+# that's already in use. Each branch (mount, swap, imported zpool, idle) is
+# driven by mocking the system-boundary commands it queries — lsblk, swapon,
+# command_exists, zpool. The /proc/mdstat branch's positive case can't be
+# unit-driven without writing to /proc, so it stays VM-harness territory; the
+# idle case below pins the negative for a name guaranteed absent from mdstat.
+# This is the error path for the "installing onto an already-mounted disk"
+# case: in_use returns 0, and the orchestrator turns that into a hard fail.
+
+@test "disk_in_use: returns 0 when a mountpoint is present" {
+    lsblk() { echo "/boot"; }
+    run disk_in_use /dev/sda
+    [ "$status" -eq 0 ]
+}
+
+@test "disk_in_use: returns 0 when active swap sits on the disk" {
+    lsblk() { :; }
+    swapon() { echo "/dev/sda2"; }
+    run disk_in_use /dev/sda
+    [ "$status" -eq 0 ]
+}
+
+@test "disk_in_use: returns 0 when the disk is a member of an imported zpool" {
+    lsblk() { :; }
+    swapon() { :; }
+    command_exists() { return 0; }
+    # -P prints full paths; a partition member (/dev/sda2) must still match
+    # the bare disk path via fixed-string search.
+    zpool() { echo "  /dev/sda2  ONLINE       0     0     0"; }
+    run disk_in_use /dev/sda
+    [ "$status" -eq 0 ]
+}
+
+@test "disk_in_use: returns 1 when the disk is idle" {
+    lsblk() { :; }
+    swapon() { :; }
+    command_exists() { return 1; }
+    # A name that won't appear in the host's /proc/mdstat keeps the final
+    # branch deterministic.
+    run disk_in_use /dev/zzz999
+    [ "$status" -eq 1 ]
+}