test:优化测试结果同步sycthing文件夹机制

test-e2e/infra/environment/shared-daily-results.md

@@ -8,7 +8,7 @@ Only `latest-report.md` and `latest-batch.zip` are managed. Batch IDs, pinned HE
 
 The package includes all selected Cases' text logs, receipts, summary, checkpoints and ownership metadata. It excludes config/env files, resolved asset configurations, inputs, dependencies, raw materials and successful screenshots. Existing config credentials and common wire credentials are redacted from text. Unreviewed binary screenshots and raw Playwright traces cannot be certified safe through text replacement: they remain on Ubuntu and are listed in `excluded-evidence.json`. This publication mechanism does not provide reviewed-binary release yet. The report explicitly states that limitation; original evidence is not removed.
 
-`manifest.json` identifies the batch and hashes every payload file. Build/verify under the ignored `state/` tree, then replace the fixed destination files with rollback on local replacement errors. Refuse symlinks and unexpected existing destination entries rather than removing historical data. Publication receipts are stored under `state/report-publications/<batch>/receipt.json`. Original batch receipts, summary and checkpoint results are never rewritten by the publisher. The normal runner only refreshes its reading report with publication status before notification.
+`manifest.json` identifies the batch and hashes every payload file. Build/verify under the ignored `state/` tree, then replace the fixed destination files with rollback on local replacement errors. Reject a symlinked destination directory and reject either managed filename if it is a symlink, directory or other non-regular entry. Unrelated files and extracted directories do not block publication: they are never read, packaged, modified or deleted. Publication receipts are stored under `state/report-publications/<batch>/receipt.json`. Original batch receipts, summary and checkpoint results are never rewritten by the publisher. The normal runner only refreshes its reading report with publication status before notification.
 
 For an already complete historical batch, use the dedicated test-home Python:
 

test-e2e/infra/tools/suite_publish.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
 """Publish a complete Daily reading bundle; never execute tests or send messages."""
 from __future__ import annotations
 
@@ -209,16 +210,18 @@ def publish_latest(batch, home, env=None, *, ownership_file=None):
     if destination.is_symlink():
         raise ValueError("Publication directory cannot be a symlink")
     destination.mkdir(parents=True, exist_ok=True)
-    for path in destination.iterdir():
-        if path.name not in (*MANAGED_FILES, ".stfolder", ".stignore") or path.is_symlink():
-            raise ValueError("Unexpected existing publication files; refusing to delete or overwrite them")
     staging_root = home / "state/report-publish-staging"
     if (home / "state").is_symlink() or staging_root.is_symlink():
         raise ValueError("Publication staging directory cannot be a symlink")
     staging_root.mkdir(parents=True, exist_ok=True)
     if destination.stat().st_dev != staging_root.stat().st_dev:
         raise ValueError("Publication staging and destination must share a filesystem")
     with BatchLock(home / "state/report-publish.lock"), tempfile.TemporaryDirectory(dir=staging_root) as temporary:
+        # Only these fixed paths are managed; never inspect or remove unrelated entries.
+        for name in MANAGED_FILES:
+            target = destination / name
+            if target.is_symlink() or (target.exists() and not target.is_file()):
+                raise ValueError("Managed publication targets must be regular files, not symlinks or directories")
         staging = Path(temporary)
         sharing = {"status": "PUBLISHED", "batch_id": batch.name,
                    "excluded_binary_count": len(excluded), "published_at": now()}

test-e2e/infra/tools/tests/test_suite_publish.py

@@ -1,3 +1,4 @@
+# Copyright (c) 2025-2026 Huawei Technologies Co., Ltd. All rights reserved.
 """Offline publication tests; no product calls, synchronization, or notifications."""
 from collections import Counter
 import hashlib
@@ -161,12 +162,57 @@ def test_invalid_text_fails_packaging_without_replacing_previous(tmp_path):
     assert (tmp_path / "runs-ubuntu/latest-batch.zip").read_bytes() == before
 
 
-def test_unknown_destination_files_are_not_deleted(tmp_path):
-    target = tmp_path / "runs-ubuntu/old-batch"
-    target.mkdir(parents=True)
-    with pytest.raises(ValueError, match="Unexpected existing"):
+def test_unrelated_destination_files_are_preserved_and_do_not_block_republication(tmp_path):
+    suite_publish.publish_latest(make_batch(tmp_path, "previous"), tmp_path)
+    destination = tmp_path / "runs-ubuntu"
+    extracted = destination / "unzip_previous_latest-batch"
+    extracted.mkdir()
+    (extracted / "report.md").write_text("previous extracted report", encoding="utf-8")
+    (destination / "operator-notes.txt").write_text("private operator notes", encoding="utf-8")
+    before = {path.relative_to(destination).as_posix(): path.read_bytes()
+              for path in destination.rglob("*") if path.is_file() and path.name not in suite_publish.MANAGED_FILES}
+    receipt = suite_publish.publish_latest(make_batch(tmp_path, "new"), tmp_path)
+    assert receipt["status"] == "PUBLISHED"
+    for name, content in before.items():
+        assert (destination / name).read_bytes() == content
+    with zipfile.ZipFile(destination / "latest-batch.zip") as package:
+        assert json.loads(package.read("manifest.json"))["batch_id"] == "new"
+        assert not any("unzip_previous" in name or "operator-notes" in name for name in package.namelist())
+
+
+@pytest.mark.parametrize("name", suite_publish.MANAGED_FILES)
+def test_managed_destination_directory_is_rejected_without_replacing_other_file(tmp_path, name):
+    destination = tmp_path / "runs-ubuntu"
+    (destination / name).mkdir(parents=True)
+    other = next(item for item in suite_publish.MANAGED_FILES if item != name)
+    (destination / other).write_bytes(b"previous managed content")
+    with pytest.raises(ValueError, match="Managed publication targets"):
+        suite_publish.publish_latest(make_batch(tmp_path), tmp_path)
+    assert (destination / name).is_dir()
+    assert (destination / other).read_bytes() == b"previous managed content"
+
+
+@pytest.mark.parametrize("name", suite_publish.MANAGED_FILES)
+@pytest.mark.parametrize("dangling", [False, True])
+def test_managed_destination_symlink_is_rejected_without_touching_target(tmp_path, name, dangling):
+    destination = tmp_path / "runs-ubuntu"
+    destination.mkdir()
+    target = tmp_path / "outside-private.txt"
+    if not dangling:
+        target.write_bytes(b"private outside content")
+    try:
+        (destination / name).symlink_to(target)
+    except OSError:
+        pytest.skip("Host does not permit creation of symlinks")
+    other = next(item for item in suite_publish.MANAGED_FILES if item != name)
+    (destination / other).write_bytes(b"previous managed content")
+    with pytest.raises(ValueError, match="Managed publication targets"):
         suite_publish.publish_latest(make_batch(tmp_path), tmp_path)
-    assert target.is_dir()
+    assert (destination / name).is_symlink()
+    assert (destination / other).read_bytes() == b"previous managed content"
+    assert target.exists() == (not dangling)
+    if not dangling:
+        assert target.read_bytes() == b"private outside content"
 
 
 def test_wrong_ownership_revision_is_rejected(tmp_path):