Beagle SCM

ABC-013: HIGH FILE/FSW: short-write data loss, uninit fd book, dead watches

FILE.c streaming/booking layer (2026-07-07 review). FILEFlushThreshold marks ALL buffered data consumed regardless of how much write() accepted — silent, permanent data loss on any partial write. The fd-book grows over uninitialized malloc memory whose garbage then passes NULL-sentinel checks. FSW watches can never be removed and kqueue leaks an fd per watch.

Input

Context

• FILE.c:610-613 FILEFlushThreshold — write() then unconditional

  Bate(buf) (B.h:228: DATA := consumed). Partial write (pipe, RLIMIT, near-full disk) loses the tail. FILEFlush (:585) does it right with u8bUsed(buf, r). Exported streaming primitive, no in-repo caller yet.

• FILE.c:676-684 FILETrimMap — truncates to u8bDataLen (b2-b1),

  ignoring PAST: any consumed bytes shorten the file; still-mapped pages past EOF then SIGBUS. FILETrimBook (:1052) correctly uses b2-b0.

• FILE.c:924-926 — FILE_BOOK gap entries are uninitialized malloc bytes

  (u8pbAllocate → Balloc, no zeroing) but NULL is the "not booked" sentinel: FILEUnBook's shrink loop reads garbage; FILEBookExtend's test(booked_end != NULL, FILENOBOOK) (:1017) accepts garbage and can mmap(MAP_FIXED) over unrelated VA from a garbage-derived book_size.

• FILE.c:851-855 — RO probe: pread != 1 → ro_empty = YES; a transient

  EINTR exposes a non-empty log as an empty buffer, no error.

• EINTR retried in FILEFeed/FILEDrain/FILEFeedv/FILEReap but NOT in

  FILEFlush (:579), FILEFlushAll (:597, also truncates write() into int), FILEFlushThreshold, FILEEnsureSoft/Hard (:623/:645), PAGEStreamFd (PAGE.c:233/251), PACK I/O (PACK.c:70,187,210,252).

• No O_CLOEXEC: FILECreate/CreateAt/Open/OpenAt (FILE.c:354-386),

  PACKCreate/Open (PACK.c:48,173), kqueue FSWDir (FSW.c:108) — fds leak into FILESpawn children; Linux FSWInit already sets IN_CLOEXEC.

• FSW: FSWUndir is (void)path; done; on BOTH platforms (FSW.c:44,123)

  — documented "remove a watch", silently OK; inotify wd discarded (:36-40) so removal is unimplementable as-is; kqueue keeps one dir fd per watch open forever, FSWClose only closes the kqueue fd (:108-119).

• FILE.c:123 — call(PATHu8bTerm, work) inside FILERmDir's readdir

  loop early-returns without closedir. FILE.c:1123 FILEScanRecurse: ≥1 KiB a_pad frame per dir level, no depth cap (FILErmrf caps at 64).

Goals

• Repro-first: FlushThreshold into a pipe with a small pipe buffer;

  TrimMap after u8bUsed; book fd N on a fresh book, then UnBook.

• Consume written bytes only; trim to b2-b0; zero the book gap

  (or a zeroing allocator); EINTR + O_CLOEXEC sweeps; real FSW removal (record wd/fd per watch) or delete the fake API.

Constraints

• Review-gated abc/. ULOG/keeper durability depends on the flush paths —

  coordinate with ULOG-002/ULOG-003 owners before touching semantics.

WIP

Design decisions

• (open)

TODOs

• repros: partial-write flush, TrimMap-with-PAST, book-gap garbage
• FlushThreshold/Flush* short-write + EINTR handling
• FILETrimMap full-length resize; FILE_BOOK zeroing
• O_CLOEXEC sweep; FSW watch bookkeeping or API removal
• closedir on the PATHu8bTerm path; recursion depth cap

Blockers and bummers

• (none)

Outcome

• (open)