Files

T

Anachronaut d6cbbb5034 Strike the three review items that are now fixed

The streamed commit is bounded, the memory map is checked against itself,
and the save guarantee says what it is. Three left: the temporary-file
namespace, one path length both implementations agree on, and a bound on
directory entries that keeps every one of them nameable as a parent.

2026-08-25 22:56:21 -04:00

3.0 KiB

Raw Blame History

Delete me after these things are fixed

Temporary notes from the SBFS v2 and CosmOS review, in priority order.

Protect the temporary-file namespace

Whole-file saves and streamed writes use the fixed names sbfs.part and sbfs.out. Starting another operation deletes an existing entry with the corresponding name as stale temporary output, but these are otherwise legal user filenames. A real user file with one of those names can therefore be deleted.

Possible resolutions:

Reserve these names and refuse ordinary creation under them.
Use a spare descriptor flag to identify temporary entries, and clean up by identity rather than by name.
Move temporary artifacts into a defined /tmp policy where appropriate. A stream's temporary currently needs to be in the destination directory because rename changes a name but not a parent, so /tmp alone may require adding a move operation.

Whatever rule is chosen should be enforced in both SplitDisk and the native SBFS code and documented as part of the format or CosmOS policy.

Establish one portable path-length limit

SplitDisk carries paths up to 511 characters, while the native path machinery appears to use a 255-byte limit. Paths are not stored on disk, so this does not change the format, but the host can construct a tree addressable by a path that CosmOS cannot express in one operation.

Declare a portable CosmOS/SBFS path limit and have SplitDisk enforce it when modifying an image. The native 255-byte limit is reasonable; the important property is agreement and documentation. Component names remain limited to 22 bytes independently.

Bound the number of directory entries

The parent field is 16 bits and stores descriptor index + 1, with zero reserved for the root. Descriptor index 65535 therefore cannot be represented as a parent because adding one wraps to zero. SplitDisk currently accepts directory sizes large enough to exceed the representable parent domain.

Define and validate a maximum directory-block/entry count such that every directory entry can be named as a parent. Apply the check while formatting and mounting/reading malformed images in both implementations.

Design strengths worth preserving

Parent-as-index-plus-one makes every version one entry a valid root child without conversion.
Directories consume one descriptor and no data blocks, leaving the descriptor array as the complete allocation map.
Files remain contiguous and the block allocator remains ignorant of hierarchy.
Path resolution below the service boundary gave existing applications directories without changing their interfaces.
The current directory is a two-byte identity rather than a stored string, and the shell restores it after applications run.
The independent host/native implementations and byte-identical disk agreement tests are unusually strong validation of the written format.
osFileStart/osFileWrite/osFileFetch/osFileDone provide the bounded-memory output abstraction needed by assemblers, compilers, linkers, and future sequential pipelines.