test: exercise full host filesystem recovery

docs/adr/0031-full-host-filesystem-fixture.mdadded+40-0

Changes to docs/adr/0031-full-host-filesystem-fixture.md

		@@ -0,0 +1,40 @@
	1	+# Full host filesystem qualification
	2	+
	3	+Status: implementation in progress for #42. Physical deployment remains disabled.
	4	+
	5	+Extend the public update-coordinator storage campaign with actual Linux ENOSPC.
	6	+Run explicitly inside a private mount namespace, verified against PID 1's mount
	7	+namespace, with kernel mountinfo readback rejecting shared or slave propagation.
	8	+Mount a new 16 MiB tmpfs only at an exclusively created private fixture
	9	+directory. Read back the filesystem type, capacity, ownership and mount identity.
	10	+No block device, existing mount or physical vehicle is involved.
	11	+
	12	+Keep signed repositories and the owned build outside the bounded filesystem.
	13	+Place the actual protocol store, candidates and slots inside it. Confirm a real
	14	+release-7 host session, prepare release 9, then publish new signed root/role
	15	+metadata. At the public slot-selection progress boundary, fill an owned sibling
	16	+file through real writes until ENOSPC and release only 1 MiB of its allocation.
	17	+The larger signed image must make actual partial progress before ENOSPC. Leave
	18	+the filesystem full until the trial process has exited, including its attempts
	19	+to record failure. Never replace filesystem or SQLite methods with faults.
	20	+
	21	+Inspect retained bytes and public status after removing only the owned filler.
	22	+Require the previous known-good image and accepted metadata/security floors to
	23	+survive without a new health confirmation. A pending attempt and selected slot
	24	+must undergo explicit fresh-process metadata recovery and exact-slot abandonment
	25	+before an unrestricted fresh trial can confirm a different slot through actual
	26	+new boot/session evidence. Preserve failed partial bytes and the older image.
	27	+
	28	+Copy and hash the full volume before freeing the filler or opening it for
	29	+inspection, then archive later retained states before unmounting the volatile
	30	+filesystem. Keep failure observations, status snapshots
	31	+and process results. CI retains these synthetic artifacts for seven days.
	32	+The opt-in Linux qualification must execute in CI; a skipped local test supplies
	33	+no positive filesystem-exhaustion evidence.
	34	+
	35	+Linux documents tmpfs capacity limits and loss of contents on unmount in
	36	+[tmpfs(5)](https://man7.org/linux/man-pages/man5/tmpfs.5.html). This is real logical
	37	+filesystem exhaustion on a memory-backed filesystem. It does not qualify storage
	38	+device exhaustion, persistent-media durability, EDQUOT, EIO, sync failures or
	39	+electrical power loss. Those remain separate acceptance requirements. The fixture
	40	+adds no production storage layer, privileged application command or dependency.