Beagle SCM

ABC-013: FILE/FSW: short-write data loss, uninit fd book, dead watches

FILE.c streaming/booking layer (2026-07-07 review). FILEFlushThreshold marks ALL buffered data consumed regardless of how much write() accepted — silent, permanent data loss on any partial write. The fd-book grows over uninitialized malloc memory whose garbage then passes NULL-sentinel checks. FSW watches can never be removed and kqueue leaks an fd per watch.

Input

Context

• FILE.c:610-613 FILEFlushThreshold — write() then unconditional Bate(buf) (B.h:228: DATA := consumed). Partial write (pipe, RLIMIT, near-full disk) loses the tail. FILEFlush (:585) does it right with u8bUsed(buf, r). Exported streaming primitive, no in-repo caller yet.
• FILE.c:676-684 FILETrimMap — truncates to u8bDataLen (b2-b1), ignoring PAST: any consumed bytes shorten the file; still-mapped pages past EOF then SIGBUS. FILETrimBook (:1052) correctly uses b2-b0.
• FILE.c:924-926 — FILE_BOOK gap entries are uninitialized malloc bytes (u8pbAllocate → Balloc, no zeroing) but NULL is the "not booked" sentinel: FILEUnBook's shrink loop reads garbage; FILEBookExtend's test(booked_end != NULL, FILENOBOOK) (:1017) accepts garbage and can mmap(MAP_FIXED) over unrelated VA from a garbage-derived book_size.
• FILE.c:851-855 — RO probe: pread != 1 → ro_empty = YES; a transient EINTR exposes a non-empty log as an empty buffer, no error.
• EINTR retried in FILEFeed/FILEDrain/FILEFeedv/FILEReap but NOT in FILEFlush (:579), FILEFlushAll (:597, also truncates write() into int), FILEFlushThreshold, FILEEnsureSoft/Hard (:623/:645), PAGEStreamFd (PAGE.c:233/251), PACK I/O (PACK.c:70,187,210,252).
• No O_CLOEXEC: FILECreate/CreateAt/Open/OpenAt (FILE.c:354-386), PACKCreate/Open (PACK.c:48,173), kqueue FSWDir (FSW.c:108) — fds leak into FILESpawn children; Linux FSWInit already sets IN_CLOEXEC.
• FSW: FSWUndir is (void)path; done; on BOTH platforms (FSW.c:44,123) — documented "remove a watch", silently OK; inotify wd discarded (:36-40) so removal is unimplementable as-is; kqueue keeps one dir fd per watch open forever, FSWClose only closes the kqueue fd (:108-119).
• FILE.c:123 — call(PATHu8bTerm, work) inside FILERmDir's readdir loop early-returns without closedir. FILE.c:1123 FILEScanRecurse: ≥1 KiB a_pad frame per dir level, no depth cap (FILErmrf caps at 64).

Goals

• Repro-first: FlushThreshold into a pipe with a small pipe buffer; TrimMap after u8bUsed; book fd N on a fresh book, then UnBook.
• Consume written bytes only; trim to b2-b0; zero the book gap (or a zeroing allocator); EINTR + O_CLOEXEC sweeps; real FSW removal (record wd/fd per watch) or delete the fake API.

Constraints

• Review-gated abc/. ULOG/keeper durability depends on the flush paths — coordinate with ULOG-002/ULOG-003 owners before touching semantics.

WIP

Design decisions

• FSWUndir DELETED (not implemented): no-op lie on both platforms, zero in-repo callers, inotify wd never recorded; kqueue per-watch dir-fd lifetime documented in FSW.h/FSW.md instead.
• Book-gap repro PASSED pre-fix: the malloc-garbage path is masked by ABC-006's memset in u8pbAllocate; gap-NULLing now explicit and the test pins the invariant.

TODOs

• repros: FILEFlushThresholdPipeTest (red: 0<>512), FILETrimMapPastTest (SIGBUS'd), FILEBookGapTest (pins invariant)
• FlushThreshold consumes written only (u8bUsed, FILE.c:616); Flush/FlushAll/Ensure* EINTR + ssize_t
• FILETrimMap trims to b2-b0 (FILE.c:693); book gap NULLed
• O_CLOEXEC sweep (FILE/PACK/FSW opens); FSW: Undir deleted
• closedir on the PATHu8bTerm path (FILE.c:123); ScanRecurse depth cap 64 -> FILELOOP (FILE.c:1150)

Blockers and bummers

• For ULOG-002/ULOG-003 owners at merge: TrimMap now KEEPS consumed (PAST) bytes on disk; FlushThreshold leaves a partial write's tail in DATA for the next flush instead of dropping it.

Outcome

• Landed in work/ABC-013, NOT merged: ?cc242e35 "ABC-013: FILE short-write + FSW fixes" (posted before the no-commit countermand reached the worker). Suite 46/46; PACK.c kept to EINTR/O_CLOEXEC only (ABC-014 boundary); orchestrator re-verified.