also looking at this
test: qualify zero-byte host image write failures
#61
5 files
+50
-27
| @@ -13,17 +13,25 @@ Keep signed repositories and the owned build outside the bounded filesystem. | ||
| 13 | 13 | Place the actual protocol store, candidates and slots inside it. Confirm a real |
| 14 | 14 | release-7 host session, prepare release 9, then publish new signed root/role |
| 15 | 15 | metadata. At the public slot-selection progress boundary, fill an owned sibling |
| 16 | file through real writes until ENOSPC and release only 1 MiB of its allocation. | |
| 17 | The larger signed image must make actual partial progress before ENOSPC. Leave | |
| 16 | file through real writes until ENOSPC. Run two independent campaigns: release | |
| 17 | only 1 MiB of its allocation for a partial image write, or leave zero free bytes | |
| 18 | for failure before any image bytes are written. Pin the selected budget in the | |
| 19 | private fixture marker and worker input, and read it back from the filesystem | |
| 20 | before the copy. Require exactly the selected number of retained image bytes, | |
| 21 | including an existing empty image file and its SHA-256 in the zero-byte case. Leave | |
| 18 | 22 | the filesystem full until the trial process has exited, including its attempts |
| 19 | 23 | to record failure. Never replace filesystem or SQLite methods with faults. |
| 24 | The existing public inspector reports an empty image as `unavailable` because | |
| 25 | valid protected images must be nonempty. A nonempty partial image is `mismatch`. | |
| 26 | Neither status grants health or installation authority; the campaign separately | |
| 27 | reads the actual retained file to distinguish empty, partial and missing bytes. | |
| 20 | 28 | |
| 21 | 29 | Inspect retained bytes and public status after removing only the owned filler. |
| 22 | 30 | Require the previous known-good image and accepted metadata/security floors to |
| 23 | 31 | survive without a new health confirmation. A pending attempt and selected slot |
| 24 | 32 | must undergo explicit fresh-process metadata recovery and exact-slot abandonment |
| 25 | 33 | before an unrestricted fresh trial can confirm a different slot through actual |
| 26 | new boot/session evidence. Preserve failed partial bytes and the older image. | |
| 34 | new boot/session evidence. Preserve failed partial or empty files and the older image. | |
| 27 | 35 | |
| 28 | 36 | Copy and hash the full volume before freeing the filler or opening it for |
| 29 | 37 | inspection, then archive later retained states before unmounting the volatile |
| @@ -35,6 +43,7 @@ no positive filesystem-exhaustion evidence. | ||
| 35 | 43 | Linux documents tmpfs capacity limits and loss of contents on unmount in |
| 36 | 44 | [tmpfs(5)](https://man7.org/linux/man-pages/man5/tmpfs.5.html). This is real logical |
| 37 | 45 | filesystem exhaustion on a memory-backed filesystem. It does not qualify storage |
| 38 | device exhaustion, persistent-media durability, EDQUOT, EIO, sync failures or | |
| 46 | device exhaustion, a write syscall returning zero without an error, | |
| 47 | persistent-media durability, EDQUOT, EIO, sync failures or | |
| 39 | 48 | electrical power loss. Those remain separate acceptance requirements. The fixture |
| 40 | 49 | adds no production storage layer, privileged application command or dependency. |