also looking at this
test: exercise full host filesystem recovery
#58
13 files
+644
-5
| @@ -182,8 +182,10 @@ cuts do not cover every write/sync boundary or actual physical power loss. | ||
| 182 | 182 | The metadata format is bounded to 256 attempts, 10,000 metadata advances and a 128 MiB |
| 183 | 183 | state database. Each attempt allows 64 inputs, 32 MiB of metadata and 512 KiB per |
| 184 | 184 | file. Exhaustion fails closed; history is not automatically deleted or compacted. |
| 185 | Capacity migration, the full storage-fault campaign, authenticated repair/key | |
| 186 | revocation, durable slot coordination and session-bound health remain in #42. | |
| 185 | Capacity migration, the full storage-fault campaign and authenticated repair/key | |
| 186 | revocation remain in #42. [Owned host slots](#owned-host-slots-and-observed-health) | |
| 187 | below add durable host roles and observed boot/session health. Physical board | |
| 188 | selection, boot health and recovery still require their separate qualification. | |
| 187 | 189 | |
| 188 | 190 | ## Protected signed-image preparation |
| 189 | 191 | |
| @@ -581,3 +583,23 @@ An actual CMake output-overflow case also stops before runtime start, retains | ||
| 581 | 583 | release floor 9 through recovery, then observes a fresh healthy trial after the |
| 582 | 584 | private build fault is removed. Build tools use native bounded process capture |
| 583 | 585 | with the existing 120-second command deadline and 2 MB per-stream limits. |
| 586 | ||
| 587 | The [host storage fixture](adr/0030-host-storage-fault-fixtures.md) also runs an | |
| 588 | actual signed large host image under a read-back 1 MiB POSIX file-size limit. | |
| 589 | The slot copy retains exactly 1 MiB of the authenticated prefix before `EFBIG`, | |
| 590 | with no trial runtime launch or health confirmation. New root/target metadata and | |
| 591 | release floor 9 survive, and the prior known-good image remains intact. Recovery | |
| 592 | and the later unrestricted trial run in separate fresh Bun processes. Only the | |
| 593 | new slot can become known-good through actual fresh runtime health; the failed | |
| 594 | partial file stays retained. CI keeps the synthetic campaign artifacts for seven | |
| 595 | days. This file-size-limit evidence leaves zero-return writes, full-medium/quota, | |
| 596 | EIO, sync and physical power-loss campaigns open. | |
| 597 | ||
| 598 | The opt-in [full-filesystem qualification](adr/0031-full-host-filesystem-fixture.md) | |
| 599 | uses a separate private Linux mount namespace and a new bounded tmpfs for the | |
| 600 | actual store, candidates and slots. It targets real ENOSPC during the image copy | |
| 601 | and SQLite failure-state persistence, then exercises explicit metadata recovery, | |
| 602 | exact-slot abandonment and a fresh host trial in new processes. Retained file | |
| 603 | archives are copied and hashed before unmount. This additional campaign is in | |
| 604 | qualification; a local skip is not positive ENOSPC evidence. Physical-media, | |
| 605 | EDQUOT, EIO, sync and power-loss acceptance remain separate. | |