Slim64FS Recovery Model (V8.6)

Last updated: 2026-05-16

Recovery Goals

• Mount a parseable filesystem image after interruption.
• Prevent silent structural corruption.
• Make post-crash behavior deterministic for the same on-disk image.
• Surface unrecoverable states via slim64fs-check/slim64fs-fsck findings.

Recovery Sequence

1. Superblock and commit selection:

• Read superblock and commit slots.
• Select the highest valid generation with valid CRC.
• Reject image if no valid authoritative commit is available.

2. Metadata base load:

• Load inode table and allocation bitmap for the selected generation.
• Load root inode and directory structures into VFS state.

3. Directory replay:

• For directories with dirlog head, replay valid records in sequence order.
• Apply CREATE/DELETE/RENAME records idempotently.
• Stop replay on malformed or CRC-bad log records and report findings.

4. Consistency validation:

• Validate inode references from directory entries.
• Validate bitmap reachability against inode block ownership.
• Validate data-block CRC on read-path and in checker when requested.

5. Operational readiness:

• If structural checks pass, mount read-write.
• If severe inconsistencies are detected, require repair (slim64fs-fsck/salvage) before normal operation.

Determinism Rules

• Commit selection is deterministic: generation then CRC validity.
• Dirlog replay is deterministic: monotonic sequence order per directory.
• Duplicate/ambiguous namespace events are classified and surfaced, never hidden.

Current V8 Status

• run_crash_matrix_v8.sh --iterations 10: 310/310 pass (all ops × all barriers, 2026-05-16).
• tools/run_fsx_v8_1_replay.sh (25 seeds, post-fsync + mid-crash): 50/50 pass.
• run_fsstress_v8.sh --iterations 100: 100/100 pass — V8.4 closed 2026-05-16.
• C1/C2 warnings preserved as explicit recoverable archaeology classes, not hidden.
• No C3_TRUE_CORRUPTION observed in any gate.

ORPHAN_INODE Policy — Deferred-Reclaim Archaeology

ORPHAN_INODE (slim64fs-check severity UNREACHABLE, exit 1) is tolerated as deferred-reclaim archaeology, not dismissed as unimportant.

What it means: an inode is allocated on disk (mode ≠ 0) but has no reachable path from the filesystem root. The inode's disk blocks are live and intact; they are simply not linked into the directory tree.

Why deferred, not immediately freed: eager reclaim at mount-time risks DIRENT_TO_FREE_INODE — if a stale dirlog chain masked the CREATE that kept the inode referenced, the inode appears parentless to the recovery code even though a reachable dirent may exist on disk. Freeing it in that case corrupts the namespace. The deferred policy is the conservative safe choice.

What it is not: "orphans don't matter." Orphan inodes represent leaked disk space and possibly unreachable user data. They are logged at mount, reported by slim64fs-check, and must be reclaimed by an explicit slim64fs-fsck maintenance pass. They do not propagate silently.

Classification boundary:

• ORPHAN_INODE alone → UNREACHABLE (exit 1) — tolerated, explicit, tracked.
• DIRENT_TO_FREE_INODE → CORRUPT (exit 2+) — never tolerated.
• BAD_DIRLOG_BLOCK_RANGE → CORRUPT (exit 2+) — never tolerated.

Open Recovery Risks

• generic/035 FUSE identity gap (directory-handle fstat after overwrite rename): deferred, documented in known-limitations.html.
• No other open corruption-class risks as of 2026-05-16.

See Also

• [[durability_contract|Durability Contract]] — the Option A contract this model implements
• [[known_limitations|Known Limitations]] — open recovery risks and deferred items
• [[crash_matrix_results|Crash Matrix]] — evidence this recovery sequence was validated against
• [[v8_1_replay_determinism_frontier|Replay Determinism]] — fsx evidence for recovery determinism