fixed race conditions + extendet test suite

docs/TESTING.md

@@ -14,9 +14,12 @@ cargo clippy --workspace --all-targets -- -D warnings
 The account-free suite exercises the filesystem syscall contract against a
 temporary local directory. This validates the runner and covers creation/open
 flags, positioned and vectored I/O, truncation and sparse files, `mmap`,
-`sendfile`, durability barriers, namespace/error semantics, open-file lifetime,
-names and enumeration, and concurrent I/O. It never reads application state or
-contacts Proton:
+`sendfile`, `copy_file_range`, durability barriers, namespace/error semantics,
+`renameat2` flags, open-file lifetime, names and enumeration, readdir stability
+under concurrent mutation, metadata updates, extended attributes, allocation and
+punched holes, refusal semantics for unimplemented operations, concurrent I/O,
+and real application workloads. It never reads application state or contacts
+Proton:
 
 ```console
 scripts/fuse-acceptance.sh --offline-only
@@ -34,6 +37,85 @@ Use a dedicated test account without irreplaceable data:
 scripts/fuse-acceptance.sh --live /mnt/on-demand-testmount
 ```
 
+### The mount is diffed against an ordinary filesystem
+
+The local reference run is not only a self-test of the runner. Every case
+records the facts it established, and a live run is compared against those
+recordings, so a case fails when the mount *differs* from an ordinary
+filesystem — not only when it raises. The report names the exact key:
+
+```
+  [DIVERGENCE] live FUSE /mnt/testmount does not match the reference filesystem:
+    ! creation and open flags.truncated.size: live=6 reference=0
+```
+
+Facts are recorded in one of two ways, chosen in the test body:
+
+- **compared** — a claim about filesystem semantics. The mount must agree.
+- **noted** — context that legitimately differs: inode numbers, block counts,
+  reported mode bits, and which optional syscalls exist at all. Reported under
+  `[capabilities]`, never a failure.
+
+Because the choice is made at each call site, the set of accepted divergences
+is visible in the test that accepts it. There is no separate allowlist to drift
+out of date. When adding a case, prefer `record`; reach for `note` only when an
+ordinary filesystem can do something a network filesystem genuinely cannot.
+
+### Operations the filesystem does not implement
+
+`git`, `rsync`, `cp -a`, `tar`, `df` and most installers probe for symlinks,
+hard links, FIFOs, device nodes, `statfs`, file locks, `copy_file_range`,
+`O_DIRECT` and `SEEK_HOLE` whether or not a filesystem offers them. The suite
+asserts that each either works or is *refused cleanly* — a recognised errno,
+never `EIO` and never a hang. A refusal that is merely unimplemented is fine;
+one that is dirty breaks software that never asked for the feature.
+
+### Regressions from the bug ledger
+
+Cases named `regression B<n>` reproduce a bug from `docs/BUGS.md` so it stays
+fixed. B69 (identical rewrite must not fork a `(sync-conflict …)` copy), B70 (an
+in-flight `.crdownload` must not be sealed as a revision) and B74 (a file
+renamed after close must keep its content) need a real mount and a reachable
+daemon; they are skipped, not failed, without one.
+
+B74 is currently **failing** — it is a live data-loss defect, not a regression
+guard, and it was found by exactly this mechanism: the B70 case failed, and
+narrowing it produced a smaller reproduction that has its own case now. Expect a
+red run against a real mount until it is fixed.
+
+A regression case asserts against the *remote* outcome, so it must wait for the
+queue to drain before reading. Reading straight back through the mount proves
+nothing: the local attribute and content caches will happily return the bytes
+that were just written even when nothing reached Drive, which is precisely how
+B74 stayed invisible.
+
+### Timeouts, reports, and hung mounts
+
+A wedged FUSE operation cannot be interrupted from Python, so each case runs
+under a soft alarm (`--timeout`, default 180s) that reports the case and lets
+cleanup run, backed by a hard stop that dumps every thread's stack and exits.
+That backstop is the only way to learn *where* a mount hung. A timeout ends the
+run: later cases against a wedged mount produce noise, not information.
+
+```console
+scripts/fuse-acceptance.sh --live /mnt/testmount \
+  --timeout 300 --report-junit results.xml --budget 30
+```
+
+`--report-json` also writes every recorded observation, which is what to attach
+to a bug report. `--budget SECONDS` flags cases that pass but got slower —
+B5 was a 186 ms-per-call regression that a pass/fail suite could not see.
+`--list` prints every case and which targets it runs against, and `--fail-fast`
+stops at the first failure.
+
+`--journal-check` fails the run if `proton-drive.service` logged any error while
+it ran. A suite can pass every assertion while the daemon logs failures behind
+it; that has happened, and it was caught only by reading the journal by hand.
+
+Abandoned `pdfs-acceptance-*` roots from a crashed run are removed at startup,
+but only if they match the exact generated name and are over an hour old
+(`PDFS_ACCEPTANCE_REAP_AGE`), so a concurrent run is never disturbed.
+
 ### Automated mode matrix
 
 The managed live runner accepts two existing, empty, unmounted directories. It
@@ -53,6 +135,16 @@ in `pdfs sync list`. Use `PDFS_ACCEPTANCE_SYNC_TIMEOUT` to extend transition
 timeouts and `PDFS_ACCEPTANCE_PDFS` to select a non-installed CLI binary, for
 example `target/debug/pdfs`.
 
+### Durability drill
+
+`--durability` restarts `proton-drive.service` in the middle of the suite and
+re-verifies the bytes written before it. `staging/` and `recovery/` can hold the
+only copy of a file whose upload has not finished, so this is the case that
+proves the queue is persistent rather than in-memory. It is opt-in because it
+interrupts a running daemon; `PDFS_ACCEPTANCE_UNIT` selects a different unit.
+
+### Selecting cases
+
 During development, `PDFS_ACCEPTANCE_ONLY` runs tests whose descriptive name
 contains the supplied text (for example `PDFS_ACCEPTANCE_ONLY=namespace`). A
 release acceptance run must leave it unset so the complete contract executes.