also looking at this
test: qualify partial host image writes and recovery
#57
9 files
+311
-7
| @@ -581,3 +581,14 @@ An actual CMake output-overflow case also stops before runtime start, retains | ||
| 581 | 581 | release floor 9 through recovery, then observes a fresh healthy trial after the |
| 582 | 582 | private build fault is removed. Build tools use native bounded process capture |
| 583 | 583 | with the existing 120-second command deadline and 2 MB per-stream limits. |
| 584 | ||
| 585 | The [host storage fixture](adr/0030-host-storage-fault-fixtures.md) also runs an | |
| 586 | actual signed large host image under a read-back 1 MiB POSIX file-size limit. | |
| 587 | The slot copy retains exactly 1 MiB of the authenticated prefix before `EFBIG`, | |
| 588 | with no trial runtime launch or health confirmation. New root/target metadata and | |
| 589 | release floor 9 survive, and the prior known-good image remains intact. Recovery | |
| 590 | and the later unrestricted trial run in separate fresh Bun processes. Only the | |
| 591 | new slot can become known-good through actual fresh runtime health; the failed | |
| 592 | partial file stays retained. CI keeps the synthetic campaign artifacts for seven | |
| 593 | days. This file-size-limit evidence leaves zero-return writes, full-medium/quota, | |
| 594 | EIO, sync and physical power-loss campaigns open. | |