pub const TRUNCATION_MARKER: &str = "=== HERMIT LOG TRUNCATED: reached the configured size bound \
(HERMIT_LOG_MAX_BYTES). Output beyond this point was DISCARDED. The run itself continued and \
was NOT affected. ===";Expand description
The in-band line a bounded log writer emits when a run’s log file reaches its configured size bound.
This lives beside the comparator, not only beside the writer that emits it,
because the comparator is the consumer that must not ignore it. The
comparison below walks the two message lists in lockstep, so it can only
ever speak for the retained prefix; a pair of logs that were both cut at the
bound would agree on that prefix while the discarded tails were never looked
at. Recognizing the marker is what keeps that from being reported as a
match. hermit-cli’s writer emits this exact line and a unit test there
binds the two by running the real writer’s output through
log_was_truncated.
This is the COMPLETE sentence, not a prefix of it. An earlier version
matched only the leading === HERMIT LOG TRUNCATED: fragment anywhere in
the text, which made the refusal fire on guest-controlled content: DETLOG
records syscall path arguments verbatim, so a guest that merely touched a
path containing that fragment poisoned its own --verify – including with
the bound already disabled, so the refusal’s own remedy was unavailable.