The temporary namespace is no longer a note

Two left: one path length both implementations agree on, and a bound on
directory entries that keeps every one of them nameable as a parent.
This commit is contained in:
Anachronaut
2026-08-25 23:22:43 -04:00
parent ce8fb721fe
commit 0c240f7ad3
-19
View File
@@ -2,25 +2,6 @@
Temporary notes from the SBFS v2 and CosmOS review, in priority order.
## Protect the temporary-file namespace
Whole-file saves and streamed writes use the fixed names `sbfs.part` and `sbfs.out`.
Starting another operation deletes an existing entry with the corresponding name as stale
temporary output, but these are otherwise legal user filenames. A real user file with one
of those names can therefore be deleted.
Possible resolutions:
- Reserve these names and refuse ordinary creation under them.
- Use a spare descriptor flag to identify temporary entries, and clean up by identity
rather than by name.
- Move temporary artifacts into a defined `/tmp` policy where appropriate. A stream's
temporary currently needs to be in the destination directory because rename changes a
name but not a parent, so `/tmp` alone may require adding a move operation.
Whatever rule is chosen should be enforced in both SplitDisk and the native SBFS code and
documented as part of the format or CosmOS policy.
## Establish one portable path-length limit
SplitDisk carries paths up to 511 characters, while the native path machinery appears to