carlos / platform Public

Request changes: two P2 findings. Round 2’s P2 is only partially closed; this HEAD is not ready to merge.

1. P2 — Over-cap parent directories still strand the flush. At restore.go:153, removal deletes only the tombstoned file and leaves every directory standing. With 2049 one-character directories, the parent path is 4097 bytes. Restore succeeds, but walk_unix.go:63 rejects that now-empty directory with ErrTooDeep, so relocation’s flush still cannot commit. Both new regression fixtures use 2048 directories, keeping the parent exactly within the cap. Add the one-level-deeper case and resolve its restore → scan → flush behavior.

1. P2 — An ancestor rename can redirect deletion outside the tombstone’s path. At restore_unix.go:72, unlinkat uses the parent descriptor obtained during descent without checking its continuing relationship to the restore root. After the first directory opens, a concurrent actor can rename that subtree elsewhere; subsequent opens and deletion continue inside the moved subtree. This can delete at an unlisted path, including outside the restore root when the actor can move the subtree there. O_NOFOLLOW prevents following a replacement symlink but does not prevent this case. Add a deterministic ancestor-rename regression and establish the required confinement or enforced exclusion of concurrent renames.

The other requested checks:

• Durability: syncing the immediate parent is sufficient for this unlink when ancestor entries remain unchanged. Syncing even after ENOENT correctly covers retry after an earlier unlink whose sync failed.
• Five ruling conditions: the implementation has descriptor-relative O_NOFOLLOW|O_DIRECTORY descent, plain-component validation, final-name-only unlinkat, cancellation checks between components, and no path-based fallback. Expected absence/type errors become no-ops; other errors propagate. Those mechanical conditions do not establish confinement against ancestor renames.
• Symlinks and directories: symlinks are not followed, including at the final name. unlinkat with flags 0 cannot remove a directory.

Static review only; no tests ran, including the full internal/host suite. HEAD remains 5065b52ae663207dd32306fbe090ad23046653d5; the working tree is unchanged.

---

FIRST PROMPT: Review the round-3 brief at HEAD 5065b52, read-only; avoid the full internal/host suite.

WHAT: Assess the deep-tombstone fix, durability, ruling conditions, races, and merge readiness.

STATUS: Review complete: two P2 findings; request changes.

NEEDED: Nothing from you for this review.

RECOMMENDED: Address both findings and cover the deeper-parent and ancestor-rename cases.

SESSION: Safe to close. No files or background processes were created.