docs: finalize RESUME — mount gate hardened (daemon-backed leg), VM deployment bugs fixed, snapshot taken

RESUME-cubefs-daemon.md

@@ -54,40 +54,43 @@ Two separate bugs hid behind the "FUSE write didn't reach the daemon" symptom:
    integration test (spins up a live cube-server, runs the two `#[ignore]`d
    daemon-backed tests via `--ignored`).
 
-## GATE STATUS (2026-08-13, end of session)
+## GATE STATUS (2026-08-13, final)
 - `./check` (fmt+test+clippy -D warnings) GREEN.
-- `./check daemon` GREEN — proves the socket-backed record round-trip against a
-  real daemon (3 ignored tests via --ignored all pass).
-- `./check mount` (live FUSE, root) GREEN — 27/27 pass. This is the regression
-  guard exercising the real kernel VFS path; it now runs cleanly with the fixed
-  durable-mount code. Run before any future filesystem work.
+- `./check daemon` GREEN — socket-backed record round-trip against a real daemon.
+- `./check mount` GREEN — NOW runs the regression suite against BOTH the
+  in-memory `--seed` mount AND a daemon-backed `--socket` mount (with its own
+  fresh daemon), plus a `durable across restart` assertion. 57/57 pass. This is
+  the regression guard exercising the real kernel VFS path for BOTH backends.
 
-## NEXT STEPS (current)
-1. ~~Repeat the single-daemon + single-mount e2e INSIDE the VM...~~ DONE (see below).
-2. Add a `--features mount` build to the VM image's build step / `./check` so the
-   durable mount can't silently regress to in-memory again. (DONE on host ./check;
-   VM image build step not yet updated.)
-3. Optionally surface `DaemonBackend::put` failures as FUSE EIO instead of
+## COMPLETED THIS SESSION (chronological)
+- Fixed `DaemonBackend` envelope round-trip (commit 0300def).
+- Fixed `--features mount` compile break (commit 8f9e7e0).
+- Enforced both via `./check daemon` (the two #[ignore]d integration tests).
+- Host: `./check` + `./check daemon` + `./check mount` all GREEN (mount now
+  covers the daemon-backed path too).
+- VM (cubelinux-vm.qcow2, was pre-fix): rebuilt cube-server + cubefs-mount from
+  the fixed source; rewired cubefs.service to `--socket /run/cube/cube.sock`
+  with `Requires=cube-server.service`; fixed TWO real deployment bugs found only
+  because the new gate exercised the socket path:
+    (a) systemd ordering cycle (cube-server Wanted cubefs, cubefs Required
+        cube-server) — broke the cycle by dropping the cubefs dependency from
+        cube-server.service.
+    (b) `ExecStartPost chmod 666` raced the daemon's socket creation under the
+        restart loop and failed the unit — made it tolerant+delayed.
+  Proved a FUSE write survives a daemon restart (WAL persistence) on the VM.
+  Injected SSH key for cube+root to drive the VM. Snapshot `fixed-durable-20260813`
+  captures the working durable stack.
+- `./check` mount stage hardened (commit da3aa3a): daemon-backed leg + durability
+  assertion; `run_fs_tests` is now backend-agnostic (self-seeds its fixture).
+
+## NEXT STEPS (remaining, low priority)
+1. Add a `--features mount` build to the VM IMAGE BUILD STEP (the run_vm / build
+   script) so a from-scratch image bake includes the FUSE adapter — the host
+   `./check` already covers it; only the image-provisioning script is behind.
+2. Optionally surface `DaemonBackend::put` failures as FUSE EIO instead of
    eprintln-only (best-effort today, acceptable).
-4. ~~Confirm the desktop "CUBE Shell" launcher execs `cubec`...~~ DONE 2026-08-13:
-   `/usr/share/applications/cube.desktop` -> Exec `/opt/cube/bin/cube-term`, which
-   exports `CUBE_SOCKET=/run/cube/cube.sock` and `exec /opt/cube/bin/cubec`. The
-   skill's #1 gotcha (must use `cubec`, not `cube repl`) is satisfied at the file
-   level (not visually launched, per user instruction to not block on viewability).
-
-## COMPLETED THIS SESSION
-- Fixed `DaemonBackend` envelope round-trip (commit 0300def) — was returning the
-  bare body instead of the full record envelope; the `--socket` mount could not
-  read back FUSE writes. Fixed by round-tripping the full envelope verbatim.
-- Fixed `--features mount` compile break (commit 8f9e7e0) — `Czyx` field access.
-- Enforced BOTH bugs via `./check daemon` (the two #[ignore]d integration tests
-  now run via --ignored and would fail if either regressed).
-- Host: `./check` + `./check daemon` + `./check mount` all GREEN.
-- VM (/var/lib/cubevm/cubelinux-vm.qcow2, was pre-fix): rebuilt cubefs-mount from
-  the fixed source, rewired cubefs.service to `--socket /run/cube/cube.sock` with
-  `Requires=cube-server.service`, and proved a FUSE write survives a daemon
-  restart (WAL persistence). Injected SSH key for cube+root to drive the VM.
-  ./check also passes inside the VM (rustfmt+clippy components added).
+3. Visually launch the "CUBE Shell" desktop launcher to confirm end-to-end (file
+   level already verified: cube-term -> cubec -> /run/cube/cube.sock).
 
 ## KEY FILES
 - /home/CUBELinux/CUBELinux-2/cubesys/src/commands.rs  (raw* commands + helpers)