test: qualify partial host image writes and recovery

docs/adr/0030-host-storage-fault-fixtures.mdadded+36-0

Changes to docs/adr/0030-host-storage-fault-fixtures.md

		@@ -0,0 +1,36 @@
	1	+# Host storage fault fixtures
	2	+
	3	+Status: qualification in progress for #42. Physical deployment remains disabled.
	4	+
	5	+Exercise storage failures through the existing public update coordinator with
	6	+real signed repositories and separate processes. Keep the enrollment, protocol
	7	+store, owned candidates, host slots and current-policy checks in the path.
	8	+Assertions read public status and actual retained files. No filesystem method or
	9	+SDK verifier is replaced.
	10	+
	11	+The first campaign uses POSIX `RLIMIT_FSIZE` on macOS and Linux. A test-only C++17
	12	+launcher sets and reads back the child's hard and soft limit, ignores `SIGXFSZ`
	13	+so an over-limit write can report `EFBIG`, then executes Bun. This small native
	14	+test exception supplies the kernel resource control that the TypeScript harness
	15	+needs. It is not linked into the application or board runtime. Stacks' bounded
	16	+process capture owns command execution and output.
	17	+
	18	+A disposable signed source checkout adds initialized padding to its host image.
	19	+It retains the neutral kernel behavior and forces the authentic executable past
	20	+the file-size limit. Prepare candidates and the prior known-good image before
	21	+the limited process starts. New signed metadata is accepted during the limited
	22	+trial. The host-slot copy must then make real partial progress and fail before
	23	+runtime launch or health confirmation.
	24	+
	25	+Retain the partial slot file and prior known-good bytes. Verify metadata and
	26	+release floors after rejection and a fresh recovery process. A later unrestricted
	27	+trial needs a new slot and actual fresh runtime health; it cannot complete the
	28	+failed slot by marker inspection. The large padded image is a host fixture,
	29	+without a board memory or timing qualification claim.
	30	+
	31	+This establishes a process-local file-size-limit failure, including an actual
	32	+short image write. It does not establish zero-return writes, ENOSPC, EDQUOT, EIO,
	33	+sync failure, full-medium behavior or electrical power-loss durability. Those
	34	+remain explicit parts of the full storage campaign. Authenticated maintenance,
	35	+board installation, boot recovery and hardware anti-rollback retain their own
	36	+acceptance gates.