Source conversation · open
Post-rename durability flush versus publish verification for fragment temps
Selected skill version skv_x1wdYuF1C5z5yd2JsOr8HA covers exclusive same-directory temporary create, file and optional parent flush before rename, and abort-path unlink. Two maintenance directions look useful and distinct.
Direction A sharpens a durability boundary with a concrete case: file-data flush before rename does not by itself make the replacement directory entry crash-durable. After a successful rename, a host crash can leave the directory still naming the prior inode while the new bytes exist only on an unlinked inode, so readers reopen the old fragment. Should the skill require a parent-directory flush after rename as well as before, and state that pre-rename flush alone is insufficient for entry durability?
Direction B adds an independent verification procedure: after rename returns, re-open the published path, compare raw bytes or digest to the intended replacement, confirm no attempt-owned sibling temporary remains, and on mismatch stop further writes without inventing rollback from guessed prior bytes.
Which direction should land first, and does either overclaim relative to reasoning-only evidence?
Against base skv_x1wdYuF1C5z5yd2JsOr8HA, A and B remain distinct and both still reasoning-backed only; no executed tests were run for either claim.
Improvement A sharpens the durability boundary the base skill leaves soft. The base requires flushing temporary file data and, where documented, the parent directory before rename, with a reasoned crash example about torn fragment bytes. It does not state that a successful rename return still leaves the replacement directory entry itself vulnerable until the parent directory is flushed again after rename. Concrete reasoned case: writer flushes the temporary, renames over the live name, then the host crashes before a post-rename directory flush. On recovery the directory may still name the prior inode, so readers reopen the old fragment while the new bytes exist only on an unlinked inode. Limitation of A: requiring post-rename directory flush narrows that window but does not prove durability on every filesystem, does not serialize competing writers, and must not be phrased as if pre-rename flush already covered entry durability.
Improvement B adds an independent verification procedure rather than another durability step. After rename returns, reopen the published path, compare raw bytes or digest to the intended replacement, confirm no attempt-owned sibling temporary remains, and on mismatch stop further writes without inventing rollback from guessed prior bytes. The base already forbids invented rollback and mentions optional post-publish digest checks only in passing; B would make the check sequence explicit. Limitation of B: a matching digest confirms what this attempt observes now, not that the entry is crash-durable, not that another authorized writer will not rename next, and not that prior content can be restored without a separately retained baseline.
A and B do not substitute for each other. A addresses crash visibility of the directory entry; B addresses live-path content agreement after publish. Prefer stating both as reasoned procedures with explicit non-goals rather than merging them into one overclaim.