Desktop atomic writes: fsync temp file + parent directory before/after rename for true crash durability

[qnbs]

TERMINAL R-15 RECONCILIATION — 2026-10-02

• GATE_3_CLOSURE = feat(core): close R-15 Gate 3 with its evidence matrix and residual owners (#445) #949 TERMINAL
• RESULTING_MAIN = 4f119e2
• CI/CD / CodeQL = SUCCESS
• HEADLESS_CRASH_DURABILITY_REQUIREMENT = SATISFIED by renderer-neutral Rust Core
• PACKAGED_PHYSICAL_POWER_LOSS = Gate 6 / security(core/R-15): Gate 6 — packaged shadow/compatibility qualification on Linux, Windows and macOS #924
• LEGACY_TS_TAURI_AUTHORITY_REPLACEMENT = Gate 7 / security(core/R-15): Gate 7 — explicit production authority switch, legacy migration and cutover #925
• PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Closed through the canonical renderer-neutral Core implementation rather than a new standalone Tauri durability authority. #949 maps the original file-sync / atomic-promotion / directory-durability / reconciliation / fault-injection requirements to implementation and tests. The current legacy TS/Tauri path remains authoritative until the separately authorized Gate 7 cutover; packaged physical power-loss qualification remains Gate 6.

HISTORICAL / SUPERSEDED — CURRENT R-15 RECONCILIATION — 2026-10-01 23:12 CEST — superseded by terminal Gate 3 closure 2026-10-02

OWNER = Gate 3 / #921
GATE_3A_HEADLESS_DURABILITY = TERMINAL via #930
GATE_3B_COMMIT / STARTUP_RECONCILIATION = TERMINAL via #937 + #940
GATE_3C_PART_1_ROOT_DIGESTS = TERMINAL via #941 → main 03a24786f1c9fda76656dbbd2a635e324331ec81
GATE_3C_PART_2_CATALOG = ACTIVE via #942 @ 48525c99ed20c88774df161b8d8c0d474a785302
GATE_3C_PART_3 = REMAINING
ISSUE_STATE = OPEN
PACKAGED_POWER_LOSS_EVIDENCE = Gate 6 / #924 where source CI cannot prove it
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Renderer-neutral Rust Core now has durable staging/promotion, marker-based commit/startup reconciliation, and terminally proven authority-root digest primitives. #942 is building the authenticated record catalog. Do not close #357 yet: Gate 3 still needs the two-phase root/anchor commit, write-protocol integration, listing/retention, complete authority reconciliation (including the asset-pair boundary), and terminal Gate 3 evidence. Packaged physical/power-loss qualification remains Gate 6.

HISTORICAL / SUPERSEDED — CURRENT R-15 RECONCILIATION — 2026-10-01 — superseded 2026-10-01 23:12 CEST

OWNER = Gate 3 / #921
GATE_3A_HEADLESS_DURABILITY = TERMINAL via #930
GATE_3B_COMMIT / STARTUP_RECONCILIATION = TERMINAL via #937 + #940
CURRENT_MAIN = e43559b9bd6c5a8b6f5ba06ed9a2da42079551e1
CURRENT_3C = Part 1 active via #941 (authority-root digests)
REMAINING = 3C part 1 terminal → part 2 catalog/shards → part 3 two-phase root/anchor commit + Gate 3 closure evidence
ISSUE_STATE = OPEN
PACKAGED_POWER_LOSS_EVIDENCE = Gate 6 / #924 where source CI cannot prove it
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Renderer-neutral Rust Core now has durable staging/promotion plus marker-based commit/startup reconciliation on proven main. That materially advances this issue, but it still does not justify closure: Gate 3C must bind committed record state into the root/catalog authority and complete the terminal Gate 3 evidence. Keep this issue open through #941 and the remaining 3C parts. Do not substitute source-level fault injection for Gate 6 packaged power-loss qualification.

HISTORICAL / SUPERSEDED — Gate 3A-only reconciliation checkpoint — 2026-10-01

OWNER = Gate 3 / #921
GATE_3A_HEADLESS_DURABILITY = DELIVERED via #930
REMAINING = 3B commit-marker/startup reconciliation + 3C authority-root/catalog commit + Gate 3 closure evidence
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The Tauri-only implementation sketch below is historical provenance, not the current architecture destination. #357 is now reconciled through renderer-neutral Rust Core Gate 3. Gate 3A already provides durable staging/promotion and platform sync semantics; do not close this issue until 3B/3C establish committed-authority/reconciliation semantics and Gate 3 records the final evidence. Packaged power-loss qualification remains Gate 6 where source/CI cannot prove it.

---

Raised by chatgpt-codex-connector during the #354 review correction loop (thread: #354 (comment) area — see PR #354 for full context).

The gap

services/fs/fsCore.ts's writeTextFileAtomic/writeFileAtomic (added in #354) write to a temp file then rename over the final path, closing the "torn/partial write" class of bug. But in the abrupt power-loss scenario specifically, this isn't a complete durability guarantee: awaiting @tauri-apps/plugin-fs's writeTextFile/writeFile only completes the equivalent of write_all() — it doesn't call fsync/sync_all(), and a rename is not itself a durability barrier on most filesystems. The OS can still hold the new content (and the directory-entry update from the rename) in a page cache buffer that hasn't hit stable storage. A reboot at exactly the wrong moment could in theory expose an empty, partial, or still-the-old-file state despite the JS-level await having already resolved.

Why not fixed in #354

The real fix needs a Rust-side Tauri command (JS-level plugin-fs doesn't expose fsync control): open the temp file, write, sync_all(), close, rename, then open and sync the parent directory too (POSIX best practice for a rename to be durable, not just atomic). This is meaningfully more surface area than a JS-only PR — new Rust command, capability wiring, and it can't be meaningfully tested in this environment (no practical way to build/run a packaged Tauri desktop app here to verify real fsync behavior under simulated power loss).

Scope for whoever picks this up

• New Tauri command (e.g. write_file_durable) in src-tauri/src/commands/, wrapping write + sync_all() + rename + parent-dir sync.
• Register in lib.rs, wire capability permissions.
• Swap fsCore.ts's writeTextFileAtomic/writeFileAtomic to call it via invoke() instead of the plugin-fs JS API, on Tauri only (web build has no equivalent concept).
• Needs rust-check (PR ci: add required Rust/Tauri compile gate on pull requests #353's new CI gate) to at least catch compile/lint issues; real durability behavior can only be verified on a packaged build under actual (or simulated, e.g. SIGKILL mid-write in a controlled test) power-loss conditions.

Lower priority than the torn-write fix already shipped in #354 — this hardens an already-real improvement further, it doesn't fix a regression.

[qnbs]

Live status audit against main 34b83a22: services/fs/fsCore.ts#writeAndReplace writes a sibling temp file and renames it, but TauriApis exposes no file sync, sync_all, or parent-directory durability operation. PR #363 improves torn-write handling and atomic replacement, but does not prove crash durability. #357 therefore remains OPEN as a renderer-neutral Rust-Core storage requirement. Closure requires durable temp-file sync, atomic replacement, parent-directory durability where supported, and a controlled interruption/recovery test.

[qnbs]

R-15 / Rev-3 architecture reconciliation — 2026-08-24

The original issue correctly identified the durability gap, but its historical proposed fix is now too Tauri-specific to be the preferred target architecture.

Canonical ownership

#445 / R-15 is the integration authority. Implement the durable-write invariant in renderer-neutral/native Rust Core infrastructure wherever practical, then expose it through the typed native/DesktopPlatform contract consumed by Tauri during transition and Qt later.

Do not create a new long-lived Tauri-only write_file_durable authority merely because the original issue was reported against @tauri-apps/plugin-fs.

Required durability contract remains valid

Preserve the substantive requirement:

1. write/stage new content;
2. flush/sync file contents as required by the platform contract;
3. atomically replace/rename;
4. persist parent-directory metadata where required/meaningful;
5. report the exact durability boundary reached;
6. recover deterministic orphan staging/temp state;
7. preserve the previous valid authoritative record on failure where possible.

Platform-specific differences (including Windows semantics where directory fsync differs from POSIX) must be explicit rather than hidden behind a false universal guarantee.

Evidence

Headless Rust tests should cover ordering/error/failure-injection semantics. Packaged/native evidence is still required for platform filesystem integration and destructive lifecycle cases that unit tests cannot prove.

Closure rule

Close this issue only when #445 explicitly maps the durability acceptance criteria to implementation + tests/evidence. Do not close it merely because an atomic rename exists.

[qnbs]

Queue / execution status — 2026-09-05

Priority: P0 as an R-15 acceptance requirement. Canonical implementation owner: #445.

This issue preserves the crash-durability invariant originally observed on the transitional Tauri filesystem path. It must not be used to introduce a new standalone Tauri-only durable-write authority now that #445 owns renderer-neutral Rust/Core secure storage.

Keep the requirement: a protected authoritative write needs evidence for the admitted platform/filesystem durability contract (temp/staging write, required sync/flush, atomic replacement, directory metadata persistence where applicable, truthful failure/recovery semantics).

Close this issue only when #445's implemented Core path explicitly satisfies and tests/evidences this invariant. Historical threat detail in this issue remains useful provenance.

[qnbs]

2026-09-24 curation checkpoint

Still OPEN as an R-15/#445 acceptance/provenance child. Do not implement a new standalone Tauri durable-write authority merely to close this issue.

Current execution order is evidence-gated: #553 has been reopened after an incorrect merge-time closure, so #445 must recompute live readiness before implementation. When #445 implementation is admitted, satisfy this issue through the canonical renderer-neutral Core durable-write path and close only with explicit crash-durability evidence for this invariant.

[qnbs]

R-15 / v1.30.0 sequencing update — 2026-10-01

This P0 is now a direct closure input to Gate 3 owner #921 under #445, targeting release #926 (v1.30.0).

The preferred final implementation is the renderer-neutral/native Core durable protected-write path, not a new standalone Tauri-only durability authority. #921 owns the required file-content sync, atomic promotion, parent-directory durability, generation reconciliation and fault-injection proof.

Close #357 only when Gate 3 evidence proves the original crash-durability requirement, or record a narrow legacy residual that is still required before Gate 7.

[qnbs]

Closed through R-15 Gate 3 (#921) — 2026-10-02

Gate 3 is terminal on main 4f119e20d472a571c96ef9c43f479f68e3c47115 (#949). Resulting main: CI/CD 36981985445 and CodeQL 36981985385 passed; Vercel Production dpl_2r1QiNXDpGw1YdG52eUbuRc3p6fx is READY on the exact SHA; HTTP 200.

This issue's crash-durability requirement is met by the renderer-neutral Rust Core durable write path. The evidence is headless and CI_ONLY on Linux, macOS and Windows runners, with injected faults; contract §20 Gate 3 closure has the per-suite matrix:

• File content sync before promotion: stage_and_promote (feat(core): add Gate 3 slice 3A durable staging and promotion (#445) #930).
• Atomic replacement: immutable generation-addressed promotion that never overwrites, plus a write-sync-rename-sync root pointer (feat(core): add Gate 3 slice 3A durable staging and promotion (#445) #930, feat(core): add the Gate 3 slice 3C two-phase root commit, crash recovery and trusted cold start (#445) #944).
• Parent-directory durability: record, marker, catalog, root, slot and pointer directories are synced. Where the platform cannot confirm a sync (Windows), the result is COMMITTED_NOT_CONFIRMED_DURABLE, never DURABLE_COMMIT_SUCCESS (feat(core): add Gate 3 slice 3A durable staging and promotion (#445) #930, feat(core): add the Gate 3 slice 3B commit protocol and startup reconciliation (#445) #940, feat(core): commit every protected write transition through the authority root (#445) #947).
• Generation reconciliation: marker chain (feat(core): add the Gate 3 slice 3B commit protocol and startup reconciliation (#445) #940), root recovery and trusted cold start (feat(core): add the Gate 3 slice 3C two-phase root commit, crash recovery and trusted cold start (#445) #944, feat(core): persist key-epoch records and enforce the cold-start key-epoch check (#445) #945), catalog (feat(core): persist the record catalog and commit catalog changes through the root (#445) #946), protected per-record startup resolution (feat(core): commit every protected write transition through the authority root (#445) #947).
• Fault-injection proof: gate3_durable_test, gate3b_commit_test, gate3c_root_commit_test, gate3c_authority_test, gate3c_protected_test.

Narrow legacy residual (recorded in contract §20 and ledger row 10): the current TypeScript/Tauri writeTextFileAtomic/writeFileAtomic path in services/fs/fsCore.ts keeps its authority until Gate 7 (#925) switches desktop storage to this Core path. As the 2026-09-24 curation required, no standalone Tauri durability authority is added. Packaged physical power-loss qualification is Gate 6 (#924).