test(ci): 100% patch coverage for with_resources seed error arms

CI diff-cover flagged 80% patch coverage: the seed-failure branches were
uncovered (internal_e2e_account.go:297-300 seed_failed 503 arm; 374-379
CreateResource/MarkResourceActive error returns).

- Add e2eSeedFastResources package-var seam (mirrors the e2eSignSessionJWT
  seam) so a test can force CreateAccount's seed_failed 503 arm without making
  the real resources table reject an insert mid-request.
- TestE2EAccount_Create_WithResources_SeedFailure_Returns503: seam → 503
  seed_failed.
- internal_e2e_account_seed_whitebox_test.go (sqlmock): the two
  seedFastResources error arms — CreateResource error + MarkResourceActive
  error after a successful insert.

seedFastResources + CreateAccount now report 100.0% func coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/internal_e2e_account.go

@@ -292,7 +292,7 @@ func (h *E2EAccountHandler) CreateAccount(c *fiber.Ctx) error {
 	//     loudly. The rows are reaped with the team.
 	var seededTokens []string
 	if req.WithResources {
-		toks, serr := h.seedFastResources(ctx, team.ID, tier, env)
+		toks, serr := e2eSeedFastResources(h, ctx, team.ID, tier, env)
 		if serr != nil {
 			metrics.E2EAccountTotal.WithLabelValues(e2eMetricOpCreate, e2eResultError).Inc()
 			slog.Error("internal.e2e.create.seed_failed", "error", serr, "team_id", team.ID.String())
@@ -362,6 +362,12 @@ func (h *E2EAccountHandler) CreateAccount(c *fiber.Ctx) error {
 // a cache row needs no dedicated infra to satisfy a list/detail journey), so
 // the seed is fast and synchronous. Any error aborts (returns it) — the caller
 // turns it into a 503 so CI never receives a half-populated account.
+//
+// A package-var seam (not a direct method call) so a test can force the
+// caller's seed_failed (503) arm without needing to make the real resources
+// table reject an insert mid-request.
+var e2eSeedFastResources = (*E2EAccountHandler).seedFastResources
+
 func (h *E2EAccountHandler) seedFastResources(ctx context.Context, teamID uuid.UUID, tier, env string) ([]string, error) {
 	tokens := make([]string, 0, len(e2eSeedResourceTypes))
 	for _, rt := range e2eSeedResourceTypes {

internal/handlers/internal_e2e_account_export_test.go

@@ -4,6 +4,7 @@ package handlers
 // internal_e2e_account_*_test.go coverage suite (package handlers_test).
 
 import (
+	"context"
 	"time"
 
 	"github.com/google/uuid"
@@ -40,6 +41,18 @@ func E2ESeedResourceTypesForTest() []string {
 	return out
 }
 
+// SetE2ESeedFastResourcesForTest overrides the e2eSeedFastResources seam so a
+// test can force CreateAccount's seed_failed (503) arm deterministically,
+// without making the real resources table reject an insert mid-request.
+// Returns a restore func.
+func SetE2ESeedFastResourcesForTest(err error) (restore func()) {
+	prev := e2eSeedFastResources
+	e2eSeedFastResources = func(_ *E2EAccountHandler, _ context.Context, _ uuid.UUID, _, _ string) ([]string, error) {
+		return nil, err
+	}
+	return func() { e2eSeedFastResources = prev }
+}
+
 // SetE2ESignSessionJWTForTest overrides the e2eSignSessionJWT seam so a test
 // can force the token_issue_failed (503) arm of CreateAccount. Returns a
 // restore func. HS256-over-[]byte never errors in practice, so this seam is

internal/handlers/internal_e2e_account_seed_whitebox_test.go

@@ -0,0 +1,77 @@
+package handlers
+
+// internal_e2e_account_seed_whitebox_test.go — whitebox coverage for the
+// with_resources seed error arms (seedFastResources). The happy seed path is
+// covered end-to-end by the external suite against a real test DB; these tests
+// drive the two failure branches deterministically with sqlmock so the 100%-
+// patch gate is satisfied without a flaky "make the real DB fail" dance:
+//
+//   - CreateResource error  → seedFastResources returns "seed <type>: ..."
+//   - MarkResourceActive err → seedFastResources returns "activate seeded ...: ..."
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"instant.dev/internal/config"
+)
+
+// resourceReturningRow builds a single fully-populated resources row in the
+// exact column order scanResource expects, so a mocked CreateResource INSERT …
+// RETURNING parses cleanly and the test can advance to the MarkResourceActive
+// step. Values are placeholders — only the shape matters.
+func resourceReturningRow() *sqlmock.Rows {
+	cols := []string{
+		"id", "team_id", "token", "resource_type", "name", "connection_url", "key_prefix", "tier",
+		"env", "fingerprint", "cloud_vendor", "country_code", "status", "migration_status",
+		"expires_at", "storage_bytes", "provider_resource_id", "created_request_id", "parent_resource_id", "paused_at",
+		"last_seen_at", "degraded", "degraded_reason", "last_reconciled_at", "auth_mode", "created_at",
+	}
+	return sqlmock.NewRows(cols).AddRow(
+		uuid.New(), uuid.New(), uuid.New(), "cache", nil, nil, nil, "pro",
+		"development", nil, nil, nil, "pending", "none",
+		nil, int64(0), nil, nil, nil, nil,
+		nil, false, nil, nil, "legacy_open", time.Now(),
+	)
+}
+
+func TestSeedFastResources_CreateResourceError(t *testing.T) {
+	db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherRegexp))
+	require.NoError(t, err)
+	defer db.Close()
+
+	// First seed type's INSERT fails outright.
+	mock.ExpectQuery(`INSERT INTO resources`).WillReturnError(errors.New("insert boom"))
+
+	h := &E2EAccountHandler{db: db, cfg: &config.Config{}}
+	toks, serr := h.seedFastResources(context.Background(), uuid.New(), "pro", "")
+	require.Error(t, serr)
+	require.Contains(t, serr.Error(), "seed")
+	require.Contains(t, serr.Error(), "insert boom")
+	require.Nil(t, toks)
+	require.NoError(t, mock.ExpectationsWereMet())
+}
+
+func TestSeedFastResources_MarkResourceActiveError(t *testing.T) {
+	db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherRegexp))
+	require.NoError(t, err)
+	defer db.Close()
+
+	// INSERT succeeds (returns a pending row); the activate UPDATE then fails.
+	mock.ExpectQuery(`INSERT INTO resources`).WillReturnRows(resourceReturningRow())
+	mock.ExpectExec(`UPDATE resources SET status = 'active'`).WillReturnError(errors.New("update boom"))
+
+	h := &E2EAccountHandler{db: db, cfg: &config.Config{}}
+	toks, serr := h.seedFastResources(context.Background(), uuid.New(), "pro", "")
+	require.Error(t, serr)
+	require.Contains(t, serr.Error(), "activate seeded")
+	require.Contains(t, serr.Error(), "update boom")
+	require.Nil(t, toks)
+	require.NoError(t, mock.ExpectationsWereMet())
+}

internal/handlers/internal_e2e_account_test.go

@@ -401,6 +401,25 @@ func TestE2EAccount_Create_WithoutResources_SeedsNothing(t *testing.T) {
 	require.Equal(t, 0, n, "no resources must be seeded when with_resources is omitted")
 }
 
+// TestE2EAccount_Create_WithResources_SeedFailure_Returns503 forces the seed
+// step to fail (via the e2eSeedFastResources seam) and asserts CreateAccount
+// surfaces a 503 seed_failed — CI must never receive a half-populated account.
+func TestE2EAccount_Create_WithResources_SeedFailure_Returns503(t *testing.T) {
+	skipUnlessE2EDB(t)
+	db, cleanup := testhelpers.SetupTestDB(t)
+	defer cleanup()
+	app := newE2ETestApp(t, db, nil, testE2EToken)
+
+	restore := handlers.SetE2ESeedFastResourcesForTest(errors.New("seed exploded"))
+	defer restore()
+
+	resp := postE2ECreate(t, app, testE2EToken, `{"tier":"pro","with_resources":true}`)
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode,
+		"a seed failure must surface as 503, never a half-populated 200")
+	out := decodeE2ECreate(t, resp)
+	require.Equal(t, "seed_failed", out.Error)
+}
+
 // --- reap --------------------------------------------------------------------
 
 func TestE2EAccount_Reap_TestCohortTeam_Purged(t *testing.T) {