← Slim64FS

Slim64FS Invariants (V6.3)

Core Contract Invariants

  1. Utilities must expose filesystem truth, not conceal it.
  2. No magical silent repair.
  3. No hidden replay.
  4. No "everything is fine" lies.
  5. slim64fs_check is read-only classification and must not mutate images.
  6. Repair pipeline is IR-first: scan -> Repair IR -> dry-run|repair -> class checkpoint -> post-check/report.
  7. --dry-run and --repair consume the same canonical Repair IR; parity is required.
  8. Repair ordering is strict and deterministic: class 1 bitmap, class 2 orphan, class 3 dirlog tail.
  9. Fail-stop behavior is mandatory: stop on first failure; do not execute later classes.
  10. Never checkpoint partial class state.
  11. V6.2 repair is bounded and conservative: no extent reconstruction, no metadata reconstruction, no V7 behaviors.
  12. No fake orphan recovery: never fabricate replacement file content for orphan inode recovery.
  13. Unsupported corruption is refused without --force; with --force, only in-scope V6.2 repairs may run.
  14. repair_kind values currently in use are: REPAIR_BITMAP_LEAK=1, REPAIR_ORPHAN=2, REPAIR_DIRLOG_TAIL=3.

Additional V6.3 Invariants

  1. flush_all_dirty_dirs precedes every s64_fs_checkpoint (KS4 — hard invariant; safe_checkpoint() enforces this unconditionally; violation is a bug, not a warning. V7 xfstests validation confirmed this invariant under adversarial load: checkpoint boundaries remained clean — no dirty-dir leakage through the checkpoint path.)

  2. Scan is always read-only; repair reopens read-write separately (run_full_scan_mode and scan_dirlog_torn_tails use s64_fs_open_readonly; s64_fs_open called only after scan completes and readonly handle is closed)

  3. repair_kind enum is append-only (existing values 1/2/3 never reordered or redefined; V7 adds new values only)

  4. slim64fs_debug requires --yes for all destructive operations (no mutation without explicit operator confirmation)

  5. slim64_fsck deprecated shim is not built or linked (kept in-tree for reference; Makefile shim-check only verifies it compiles, never runs it)

See Also