Volume::Open forces read-only protection on a partially encrypted
system volume, but the FUSE backend used the requested protection and
attached the loop device and mounted the filesystem read-write.
Copy the effective protection into the mount options before choosing
the backend. Run the linked mount test in CI, check raw writes and
journal recovery in the VM test, and document that a filesystem
needing journal recovery may refuse a read-only mount.
Pass --readonly to dmsetup for every cipher layer using the opened volume's protection, including access-error fallback. Use the same protection for the container loop and filesystem, and keep hidden-volume protection on FUSE.
Remove the losetup retry that silently drops -r. Add regression tests linked to the production backend and disposable-VM coverage for file and virtual-device hosts, cascades, filesystem-free mounts, writable mounts, FUSE, and failed setup cleanup.
Mounir IDRASSI