[mengmengmengqiang]

Summary

Slices 1–2 of #547, rebased onto layerfs_v2_0_0 (e9b903eac, #543 merged). Slice 1 restores the daemon-slot regression suite that #543 deleted; slice 2 puts the slot-custody state machine into the shape the recovery work needs, with no behavior change.

17 files, +862 −147. Two commits, authorship kept.

What this does

Slice 1 — restore the regression suite (test-only) — 4a0c3bd01

• engine/crates/layerfs-daemon/tests/daemon_slots.rs: the four real-daemon custody assertions over TCP — an undecodable record frees its slot, a full pool writes the capacity notice, and a concurrent failure storm neither deadlocks nor leaks.
• engine/crates/layerfs-daemon/tests/slot_state.rs: the deleted owner/retained unit assertions plus the guard-drop release, driven through the published state machine.
• Slots/RetainedFailures and their methods are now pub, re-exported behind a #[doc(hidden)] application::internals module so tests/ can exercise them.

Slice 2 — structure, no behavior change — 50243b9c4

• RetainedFailures moves out of Slots into State; Slots keeps only the slot table.
• The pure disposition() classifier and the capacity_report() read model are extracted. disposition(&ConnectionFailure, SlotTicket, &str, Instant) builds the bounded record outside the lock and Slots::finish applies it; capacity_report(SlotCounts, RetainedSnapshot) is the read model.
• SlotClass replaces the reserved slot: usize that control_operation/hello took.
• AdmissionClass::Lease, AdmissionReason::ReservedBusy and the CAPACITY_OPERATION aliases are deleted: layerfs_bridge::control::OPERATION is now the one name for the operator capacity/retained-failure read.

Rebase

Rebased from d788cc0a onto e9b903eac. One conflict, control/crates/layerfs-control/src/doctor/capacity.rs: #543 moved that query into layerfs_sandbox::daemon::capacity, so that file takes the base version and the slice's local OPERATION const duplication stays deleted. Slice 2's CAPACITY_OPERATION → OPERATION rename was carried into the four call sites #543 added (daemon/capacity.rs, host/call.rs, api/tests/sandbox_capacity.rs, sandbox/tests/capacity_read.rs), so the rename does not resurrect the alias. No commits squashed.

Test evidence

Dell aluminium (x86_64, 88 cores), rustc 1.85.1:

cargo +1.85.1 fmt --all -- --check                                              # rc=0
cargo +1.85.1 clippy --workspace --exclude layerfs-node --all-targets -- -D warnings   # rc=0
cargo +1.85.1 test -p layerfs-daemon --lib                                      # ok, 0 tests (same as base)
cargo +1.85.1 test -p layerfs-daemon --test daemon_slots --test slot_state      # ok
    daemon_slots.rs: 3 passed, 0 failed
    slot_state.rs:  10 passed, 0 failed
cargo +1.85.1 test -p layerfs-api -p layerfs-control -p layerfs-sandbox --no-fail-fast
    # 11 failures — all pre-existing, see below

The 11 failures are not from this branch. I built and ran the same -p layerfs-api -p layerfs-control -p layerfs-sandbox suite on unmodified e9b903eac: base fails 12 of those tests (including one this branch fixes), and this branch's failing set is a strict subset of base's — zero new failures.

They are a host limitation of the test machine, not of the code: the kernel-mount suites need /dev/fuse owned by the test user and fail as a normal user with kernel attach Mount: Operation not permitted (os error 1) / FUSE device ownership/type. Run as root they pass, but the daemon refuses to start when the command uid equals the owner uid, so daemon_slots/slot_state need a non-root user. The suite therefore cannot be green in one configuration on that host.

Refs #547, #540 — not closing either.