Accept safe overlay work residue after unmount

crates/lazaret-state-anchor/tests/authority.rs

@@ -2,7 +2,7 @@ use std::collections::BTreeMap;
 use std::ffi::OsString;
 use std::fs::{self, File};
 use std::os::unix::ffi::OsStringExt;
-use std::os::unix::fs::MetadataExt;
+use std::os::unix::fs::{MetadataExt, PermissionsExt};
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 
@@ -21,6 +21,45 @@ use lazaret_state_anchor::{
 
 static SEQUENCE: AtomicU64 = AtomicU64::new(0);
 
+#[test]
+fn maintenance_accepts_exact_empty_fuse_overlayfs_work_shape() {
+    let tree = TestTree::new();
+    let configuration = configuration(&tree);
+    let layout = StateAnchorLayout::create(&configuration).unwrap();
+    let nested = domain_path(&configuration).join("state-anchor/work/work");
+    fs::create_dir(&nested).unwrap();
+    fs::set_permissions(&nested, fs::Permissions::from_mode(0o700)).unwrap();
+
+    layout.inspect_state().unwrap();
+}
+
+#[test]
+fn maintenance_refuses_mutated_fuse_overlayfs_work_shapes() {
+    let tree = TestTree::new();
+    let configuration = configuration(&tree);
+    let layout = StateAnchorLayout::create(&configuration).unwrap();
+    let work = domain_path(&configuration).join("state-anchor/work");
+    let nested = work.join("work");
+    fs::create_dir(&nested).unwrap();
+    fs::set_permissions(&nested, fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(layout.inspect_state().is_err());
+
+    fs::set_permissions(&nested, fs::Permissions::from_mode(0o700)).unwrap();
+    fs::write(nested.join("unexpected"), b"").unwrap();
+    assert!(layout.inspect_state().is_err());
+
+    fs::remove_file(nested.join("unexpected")).unwrap();
+    fs::write(work.join("unexpected"), b"").unwrap();
+    assert!(layout.inspect_state().is_err());
+
+    fs::remove_file(work.join("unexpected")).unwrap();
+    fs::remove_dir(&nested).unwrap();
+    let foreign = tree.path.join("foreign-work");
+    fs::create_dir(&foreign).unwrap();
+    std::os::unix::fs::symlink(foreign, nested).unwrap();
+    assert!(layout.inspect_state().is_err());
+}
+
 #[test]
 fn selected_reset_removes_exact_state_and_whiteout_without_touching_siblings() {
     let tree = TestTree::new();

crates/lazaret-state-anchor/tests/state-anchor-lifecycle.rs

@@ -191,6 +191,7 @@ fn run() -> io::Result<()> {
         ));
     }
     first.unmount().map_err(io::Error::other)?;
+    layout.inspect_state().map_err(io::Error::other)?;
 
     let second = acquire(&layout, &artifact)?;
     if fs::read(layout.merged().join("usr/bin/installed-tool"))? != b"persistent"