Complete terminal management workflow

docs/TESTING.md

@@ -17,6 +17,21 @@ cargo build --locked --release
 
 Use only supported feature combinations; do not assume `--all-features` is valid. Keep privileged integration tests out of the default test suite. If a check cannot run, report the exact limitation rather than claiming success. Documentation-only edits do not require rebuilding the application.
 
+The unprivileged TUI fixture commands currently available are:
+
+```sh
+cargo test --locked --test tui_workflow
+cargo test --locked tui::
+```
+
+`tui_workflow` runs setup with a redacted invalid-source anomaly, client
+creation/rename, Commit, first-file and QR delivery, manual backup/list, and
+preview/cancel/confirm restore through the serialized application worker. It
+uses temporary settings/server/source files and a fake statistics reader; it
+does not invoke service or runtime mutation.
+The `tui::` filter covers forms, rendering, worker responsiveness/staleness,
+QR fit, and terminal cleanup/error seams. It does not require root or a PTY.
+
 Prioritize meaningful behavioral checks:
 
 - Configuration round trips preserve untouched bytes, unknown fields, and administrator comments; managed metadata cannot escape its comment block.
@@ -30,6 +45,33 @@ Prioritize meaningful behavioral checks:
 
 Test externally observable behavior and high-impact failure paths. Avoid tests that merely repeat implementation details, introduce root requirements, or assert real secrets in snapshots. Broaden testing when failures or new risks justify it.
 
+### Terminal smoke coverage
+
+`cargo test --locked --test tui_workflow terminal_pty_smoke -- --nocapture`
+launches the terminal loop through `script` with a synthetic `Application` and
+an injected fake unavailable-statistics reader. It enters at 80×24, changes to
+40×8 and back to 80×24, sends Ctrl-C (handled as the normal exit request), and
+asserts the alternate screen and cursor are restored. The setup is not root
+management startup and does not read host settings or query host WireGuard.
+The test reports itself incomplete if the
+`script` utility is unavailable. In the workflow test, an actual first-delivery
+QR result is transferred into the disclosure owner and Esc clears it; the
+renderer fit test separately checks complete quiet-zone dimensions. These
+checks are synthetic PTY/UI evidence, not phone/decoder interoperability.
+The PTY test exercises handled interruption and normal terminal restoration;
+`cargo test --locked tui::terminal::tests::lifecycle_failures_restore_terminal_modes_in_isolated_pty -- --nocapture`
+uses `script` to launch five isolated child probes at 80×24. The probes stop
+after raw-mode setup, stop after alternate-screen setup, return synthetic
+render and input I/O errors after full setup, and panic after full setup. Each
+child checks raw mode is off on return; the parent checks that alternate-screen
+and cursor enter/restore sequences match the resources reached. The panic case
+also checks that the panic hook emits its generic internal-failure diagnostic
+without the synthetic panic payload. These probes use the same private lifecycle
+guard and setup methods as production, without an environment-controlled
+production path or application/service adapters. The test reports itself
+incomplete if `script` is unavailable. PTY evidence remains synthetic; it does
+not test terminal-emulator behavior beyond the emitted control sequences.
+
 ## Integration testing with Alpine Testcontainers
 
 Production access is limited and experimentation on the production VPN is prohibited. Use three complementary levels: ordinary unit/fixture tests, explicitly selected Alpine container integration tests, and a separate disposable Linux VM for real systemd/D-Bus acceptance. No level authorizes using production as a test environment.