backup: #904 v13 - claude v12 doc fix + two carry-over cleanups

## Claude v12 mandatory: writeAndPublish godoc missed v12 cleanup

The godoc described only the temp-file deferred cleanup but omitted
the new stale-<output>.fsm removal added in v12. A future reader
auditing the on-disk state after self-test mismatch would see only
the temp-file cleanup documented and need to grep for cfg.outputPath
to discover the second removal. Expanded the godoc to call out both.

## Claude v12 carry-over: canonicalizeInput swallowed os.Open error

The test helper used "f, _ := os.Open(tmpOut)" and passed nil to
DecodeSnapshot if the open failed, producing a panic or misleading
decode error instead of a clean t.Fatalf. Fixed: check the error
explicitly and defer the Close. CodeRabbit flagged this on v11/v12.

## Claude v12 carry-over: test name contradicted its assertion

TestCLISelfTestMismatchWritesSidecarWithMatchedFalse asserted
os.IsNotExist on the sidecar — the encode never ran on the
manifest-floor path it exercises. Name renamed to
TestCLIManifestFloorLeavesNoStaleSidecar to match the actual
assertion. The real "sidecar IS written with matched=false on
self-test mismatch" behavior is now pinned end-to-end by
TestCLIWriteAndPublishRemovesStaleFSMOnSelfTestMismatch (v12) which
drives a real self-test mismatch through the new corruption seam.
Docstring updated to explain the rename history.

## Caller audit per CLAUDE.md semantic-change rule

All v13 changes are doc/identifier/error-handling only. No public
or package-private function signature, error semantics, or return
contract changed. Renamed test has no callers (Go testing framework
discovers by prefix). canonicalizeInput's error handling is strictly
safer — any open failure now surfaces at the failure site.

Tests + lint green.

Author: bootjp

cmd/elastickv-snapshot-encode/main.go

@@ -314,8 +314,10 @@ func buildEncodeOptions(cfg *config, effectiveTS uint64, manifest backup.Manifes
 
 // writeAndPublish writes the .fsm to a temp path, runs the optional
 // self-test via EncodeSnapshot, and renames temp → output on success.
-// On self-test failure: writes mismatch.txt, removes the temp file via
-// the deferred cleanup, returns errSelfTestMismatch.
+// On self-test failure: writes mismatch.txt, removes any stale
+// <output>.fsm left by a prior successful run (codex P2 v10 #904),
+// removes the temp file via the deferred cleanup, returns
+// errSelfTestMismatch.
 func writeAndPublish(cfg *config, encodeOpts backup.EncodeOptions, mismatchPath string, logger *slog.Logger) (backup.EncodeResult, error) {
 	tempPath, err := tempOutputPath(cfg.outputPath)
 	if err != nil {

cmd/elastickv-snapshot-encode/main_test.go

@@ -275,14 +275,17 @@ func canonicalizeInput(t *testing.T, rawIn string, lastCommitTS uint64) string {
 	if err != nil || code != exitSuccess {
 		t.Fatalf("canonical encode: code=%d err=%v", code, err)
 	}
-	f, _ := os.Open(tmpOut)
+	f, oerr := os.Open(tmpOut)
+	if oerr != nil {
+		t.Fatalf("open canonical output: %v", oerr)
+	}
+	defer func() { _ = f.Close() }()
 	if _, err := backup.DecodeSnapshot(f, backup.DecodeOptions{
 		OutRoot:  canonicalIn,
 		Adapters: backup.AdapterSet{SQS: true},
 	}); err != nil {
 		t.Fatalf("canonical decode: %v", err)
 	}
-	_ = f.Close()
 	emitMinimalManifest(t, canonicalIn, lastCommitTS)
 	return canonicalIn
 }
@@ -457,25 +460,27 @@ func TestCLIRoundTripSelfTestAllAdapters(t *testing.T) {
 	}
 }
 
-// TestCLISelfTestMismatchWritesSidecarWithMatchedFalse pins codex P2 v6
-// #904: when --self-test detects a mismatch, the CLI MUST still write
-// <output>.encode_info.json with self_test.matched=false alongside
-// <output>.mismatch.txt. Operators need both files to diagnose a
-// failed self-test (sidecar carries SHA256, effective T, adapters).
+// TestCLIManifestFloorLeavesNoStaleSidecar pins that the
+// manifest-floor preflight failure (--last-commit-ts T < manifest;
+// fails in resolveLastCommitTS BEFORE writeAndPublish) leaves NO
+// <output>.encode_info.json on disk — neither a fresh one nor a
+// stale one from a prior run (the pre-encode cleanup at the start
+// of encodeOne removes it).
 //
-// Driven via --last-commit-ts T < manifest (data-error path) since
-// that's the only deterministic CLI-level mismatch trigger; a real
-// self-test mismatch needs the same write path. Future cleanup: when
-// the library-level corruption hook is exposed via a build-tagged
-// CLI test seam, switch to a real self-test mismatch trigger.
-func TestCLISelfTestMismatchWritesSidecarWithMatchedFalse(t *testing.T) {
+// Note: the test name was previously TestCLISelfTestMismatchWritesSidecarWithMatchedFalse,
+// which contradicted the assertion (the encode does NOT run on this
+// path, so no sidecar is written). The actual sidecar-on-mismatch
+// behavior is now pinned end-to-end by
+// TestCLIWriteAndPublishRemovesStaleFSMOnSelfTestMismatch using the
+// CLI-level corruption seam (codex P2 v6/v10 #904; claude v12 rename).
+func TestCLIManifestFloorLeavesNoStaleSidecar(t *testing.T) {
 	t.Parallel()
-	// We can drive a real self-test mismatch path at the library
-	// level (covered by TestEncodeSnapshotSelfTestDetectsCorruption).
-	// At the CLI level, we additionally need to confirm the sidecar
-	// is published on the data-error branch — the manifest-floor
-	// regression path that exit-2's via the same wrap-then-return
-	// code that previously skipped writeSidecar.
+	// The pre-encode cleanup at the top of encodeOne removes any
+	// stale <output>.encode_info.json before writeAndPublish runs.
+	// On the manifest-floor path, resolveLastCommitTS exits with
+	// exit-2 BEFORE that cleanup even runs (it's the second step in
+	// encodeOne after readInputManifest). So the assertion is: a
+	// fresh TempDir produces no sidecar at all.
 	in := t.TempDir()
 	emitMinimalManifest(t, in, 1000)
 	out := filepath.Join(t.TempDir(), "out.fsm")