Harden CLI and configuration contract coverage

internal/core/config/env_contract_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"reflect"
 	"strings"
 	"testing"
@@ -144,6 +145,42 @@ cache:
 	}
 }
 
+func TestDefaultCacheRootsRejectInvalidUserCacheResolvers(t *testing.T) {
+	tests := []struct {
+		name     string
+		resolver func() (string, error)
+		want     string
+	}{
+		{name: "nil resolver", want: "must not be nil"},
+		{
+			name: "resolver failure",
+			resolver: func() (string, error) {
+				return "", errors.New("cache home unavailable")
+			},
+			want: "resolve user cache directory",
+		},
+		{name: "empty directory", resolver: func() (string, error) { return "  ", nil }, want: "must not be empty"},
+	}
+	families := []struct {
+		name string
+		root func(func() (string, error)) (string, error)
+	}{
+		{name: "chunk plans", root: DefaultChunkPlanRoot},
+		{name: "checkpoints", root: DefaultCheckpointRoot},
+	}
+
+	for _, family := range families {
+		for _, tt := range tests {
+			t.Run(family.name+"/"+tt.name, func(t *testing.T) {
+				_, err := family.root(tt.resolver)
+				if err == nil || !strings.Contains(err.Error(), tt.want) {
+					t.Fatalf("error = %v, want substring %q", err, tt.want)
+				}
+			})
+		}
+	}
+}
+
 func TestEnvEmptyDirectoryOverridesAreErrors(t *testing.T) {
 	tests := []string{
 		"NOTARIUS_OUTPUT_DIR",