resmgr: the cluster role import test verifies the imported state

Author: PF9-pushkar

docs/superpowers/plans/2026-09-03-host-cluster-role-import.md

@@ -512,4 +512,4 @@ Restore `REPO_DIR` in `suite.env`. Nothing from this task is committed.
 - **Spec coverage.** Design §1 (import writes the default) → Task 3. Design §2 (helper + Update short-circuit, equality rules for null/""/unknown/empty/order) → Tasks 1–2; every equality rule in the spec has a table row in Task 1. Testing section: helper table test → Task 1; ImportState unit test via `tfsdk.State` → Task 3; Update no-op through framework types → Task 2; lab check as the live fallback → Task 5. Changelog → Task 4. Non-goals respected: no schema change, no read-back of `host_cluster`/`backends` (Task 3 asserts they stay null).
 - **Placeholders.** None: every step carries its code or its exact command and expected output.
 - **Type consistency.** `roleOptionsChanged(plan, state *hostClusterRoleModel) bool`, `hostClusterOption`, `backendsOption` are defined in Task 1 and used with the same signatures in Task 2. `roleSchema(t)` and `roleState(t, m)` are defined in Task 2 and reused in Task 3. `roleModel` and `backendsList` are defined in Task 1's test file and reused in Tasks 2–3.
-- **Post-approval addition.** At the final whole-branch review, the reviewer asked for the acceptance test described in Task 5/the Testing section to actually exist rather than stay a documented manual fallback. Added `TestAccResmgrHostClusterRoleImport` (and `testAccCheckHostClusterRoleDestroy`) to `internal/services/resmgr/resmgr_test.go`, gated on `PCD_ACC_RESMGR` and `PCD_ACC_HOST_ID`, by user decision — the plan and the branch now agree.
+- **Post-approval addition.** At the final whole-branch review, the reviewer asked for the acceptance test described in Task 5/the Testing section to actually exist rather than stay a documented manual fallback. Added `TestAccResmgrHostClusterRoleImport` (and `testAccCheckHostClusterRoleDestroy`) to `internal/services/resmgr/resmgr_test.go`, gated on `PCD_ACC_RESMGR` and `PCD_ACC_HOST_ID`, by user decision — the plan and the branch now agree. Its steps are create, ImportStateVerify, destroy-poll: create the role and check its attributes, import it into a fresh working directory and let `ImportStateVerify` compare the imported attributes against the created state, then `testAccCheckHostClusterRoleDestroy` polls the host record after destroy until the role clears.

internal/services/resmgr/resmgr_test.go

@@ -118,9 +118,12 @@ func testAccCheckHostConfigDestroy(t *testing.T) resource.TestCheckFunc {
 	}
 }
 
-// TestAccResmgrHostClusterRoleImport assigns a cluster role, imports it, and
-// checks the plan is clean afterwards — the import used to leave
-// wait_until_converged null and plan a spurious update that re-PUT the role.
+// TestAccResmgrHostClusterRoleImport assigns a cluster role, then imports it
+// into a fresh working directory and lets ImportStateVerify compare every
+// imported attribute against the state created in the first step. Before the
+// fix, the imported state left wait_until_converged null while the created
+// state held false, so ImportStateVerify failed on the pre-fix code and
+// passes on the fixed code.
 // Mutates the control plane, so it is opt-in: PCD_ACC_RESMGR=1 and
 // PCD_ACC_HOST_ID=<host uuid> (an onboarded host that has a host configuration
 // assigned). PCD_ACC_CLUSTER_ROLE picks the role (default image-library); the
@@ -156,11 +159,12 @@ resource "pcd_host_cluster_role" "test" {
 					resource.TestCheckResourceAttr(rn, "wait_until_converged", "false"),
 				),
 			},
-			// Import into the working state (ImportStatePersist) so the plan-only
-			// step below runs against the *imported* state — that is the plan that
-			// used to show `+ wait_until_converged = false`.
-			{ResourceName: rn, ImportState: true, ImportStateId: hostID + "/" + role, ImportStateVerify: true, ImportStatePersist: true},
-			{Config: cfg, PlanOnly: true},
+			// ImportState runs in its own, fresh working directory; ImportStateVerify
+			// then diffs every attribute of that imported state against the state
+			// created above. That diff is the regression guard: before the fix, the
+			// imported state left wait_until_converged null while the created state
+			// held false, so this comparison failed.
+			{ResourceName: rn, ImportState: true, ImportStateId: hostID + "/" + role, ImportStateVerify: true},
 		},
 	})
 }