Refuse a streamed file that commits more than it reserved

osFileStart sets an extent aside and osFileWrite refuses a block index outside
it, so writing off the end was already barred. Committing a larger size was
not, and reaches the same neighbour by simply claiming it: a directory entry is
the only record of what a file owns, so an entry claiming a block it was never
given owns it, and so does whatever owned it before. Both files then look
perfectly well formed. The free count went backwards past zero on the same
path.

Found by ChatGPT's review of the streaming work, in NOTES.md. I had bounded the
index because writing off the end was the obvious way to reach a neighbour, and
had not noticed that the other end of the same reservation was open.

THE SIZE IS COMPARED, NOT THE ROOM IT TAKES UP. One block and a tail occupies
exactly what two whole blocks occupy, so bounding the blocks alone would let a
file reserve the first, commit the second, claim no block it was not given, and
still report two hundred and forty six bytes that were never written to it -
whatever the disk had there before.

Checked before anything is touched, which is why the temporary is found twice.
The old file is deleted a few lines down and a refusal after that point would
have destroyed the thing it was protecting.

AND IT CAUGHT A REAL ONE IMMEDIATELY. The assembler reserves the file plus room
for its vectors, and asked for four bytes per vector DECLARED - which looks like
a safe bound and is not, because a device is declared during the SECOND pass, in
the line that implements it. A program with a device installs a vector that was
not counted when the room was measured. CosmOS reserved 14,163 bytes and
committed 14,167, writing four bytes past what it had been given on every build
since S2. It landed inside the last block it owned, and would not have if the
boundary had fallen four bytes earlier.

It reserves against the vector table's LIMIT now, which cannot go stale whenever
things are counted.

Claim.asm is the program that tries it: reserve one block and a tail of ten,
write them, then tell osFileDone the file came to two whole blocks. The refusal
and the honest commit that follows are both recorded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2JrLzFvuFX9fgi1LDRjrW

Tests/manifest

@@ -329,6 +329,10 @@ cosmosType           | CosmOS/Source/cosmos.asm           | run      | cosmosTyp
 # with Space, and one line with Return. The input is intentionally packed so that the one
 # byte the pager consumes leaves the next shell command immediately behind it.
 cosmosMore           | CosmOS/Source/cosmos.asm           | run      | cosmosMore.in      | -     | disks/type.img
+# Copy and Compare exercise both halves of block streaming together. Empty, exact-block,
+# part-block and 84,000-byte files are copied through one buffer; Compare checks the copies
+# and a same-sized file whose only difference is deep into the input.
+cosmosCopyCompare    | CosmOS/Source/cosmos.asm           | run      | cosmosCopyCompare.in | -   | disks/copycompare.img
 # Reading a disk that has directories on it. The machine can walk a path at this point but
 # cannot make a directory, so the disk is built by the host tool and read here - which is
 # the two implementations checking each other rather than either checking itself.
@@ -348,6 +352,23 @@ cosmosTree           | CosmOS/Source/cosmos.asm           | run      | cosmosTre
 # hold no blocks and must therefore be in nobody's way when a run of free ones is wanted.
 # The listing afterwards says where it landed and how big it is.
 cosmosTreeWrite      | CosmOS/Source/cosmos.asm           | run      | cosmosTreeWrite.in | -     | disks/treewrite.img
+# Committing a streamed file bigger than the room reserved for it, which must be refused.
+#
+# osFileStart sets an extent aside and osFileWrite already refuses a block index outside it,
+# so writing off the end is barred. This is the same neighbour reached the other way: claim
+# the extra block at commit rather than write into it. A directory entry is the only record
+# of what a file owns, so an entry claiming a block it was never given simply owns it, and
+# so does whatever owned it before - both files then look perfectly well formed.
+#
+# The size is compared and not the room it takes up, because those differ: one block and a
+# tail occupies what two whole blocks occupy, so bounding the blocks alone would allow a
+# file to report two hundred and forty six bytes that were never written to it. The
+# reservation here is one block and a tail of ten, and the claim is two whole blocks - the
+# same two blocks, and a bigger lie.
+#
+# The listing at the end is the point: 266 bytes, which is what was reserved and what was
+# written, after the refusal and the honest commit that follows it.
+cosmosClaim          | CosmOS/Source/cosmos.asm           | run      | cosmosClaim.in     | -     | disks/claim.img
 # The machine building its own tree. It starts with a blank version one disk and makes
 # every directory on it, which is the half of the filesystem the machine could only read
 # until now.
@@ -422,7 +443,10 @@ app-Stream           | CosmOS/Apps/Stream.asm             | assemble | -
 app-Type             | CosmOS/Apps/Type.asm               | assemble | -                  | -
 app-Wander           | CosmOS/Apps/Wander.asm             | assemble | -                  | -
 app-Pour             | CosmOS/Apps/Pour.asm               | assemble | -                  | -
+app-Claim            | CosmOS/Apps/Claim.asm              | assemble | -                  | -
 app-More             | CosmOS/Apps/More.asm               | assemble | -                  | -
+app-Copy             | CosmOS/Apps/Copy.asm               | assemble | -                  | -
+app-Compare          | CosmOS/Apps/Compare.asm            | assemble | -                  | -
 # The assembler that runs on the machine, and its parts. Checked on their own so that a
 # failure reads as "it does not assemble" rather than as a broken disk image.
 asm-Asm              | CosmOS/Assembler/Asm.asm           | assemble | -                  | -