From fc00f1e5bc9687c09aebcabb2b35c6acfe27a954 Mon Sep 17 00:00:00 2001 From: Elvis33LE <67311580+Elvis33LE@users.noreply.github.com> Date: Wed, 7 Oct 2026 21:49:13 +0200 Subject: [PATCH] scorecard: BUG-203 (atomic saves) is done - flip the stale rows (#203) (#687) The BUG-203-1..6 and REL-4 rows still say missing, but the atomic-save work landed in #230 (8227071, 2026-10-05) - apparently after the 4b53f62 snapshot these statuses were verified against. Re-verified against the current tree: - one shared photocraft_format::atomic_write (same-dir temp, create_new + write_all + sync_all, rename, Unix directory fsync, Windows PermissionDenied rename retry with backoff), and every document write site routes through it (engine file_cmds/preset_store, automation files/headless/workspace, app services, format store/autosave); - no in-place fallback exists; read-only dir, disk-full and cross-device errors name the cause and state the original was not changed; - format/src/atomic/tests.rs failure-injects mid-write, rename and read-only-dir errors (11 tests; re-run for this change: green). The regenerated docs/scorecard.md moves Reliability to 4/1/2 and Open bugs to 12/3/17. No code changes. --- docs/scorecard.md | 18 +++++++++--------- scorecard/bugs.toml | 27 ++++++++++++++------------- scorecard/reliability.toml | 7 ++++--- 3 files changed, 27 insertions(+), 25 deletions(-) diff --git a/docs/scorecard.md b/docs/scorecard.md index a81703e2..031a9320 100644 --- a/docs/scorecard.md +++ b/docs/scorecard.md @@ -12,9 +12,9 @@ Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.js | [Workspace and UI](#workspace-and-ui) | 0 | 5 | 18 | settings that do nothing: 60 of 135 (target 0) | | [Type](#type) | 0 | 3 | 6 | | | [Automation](#automation) | 1 | 3 | 7 | 626 of 626 menu items live (100.0%) | -| [Reliability](#reliability) | 3 | 1 | 3 | never-crash lints on 27 of 27 crates; panic_hunt present | +| [Reliability](#reliability) | 4 | 1 | 2 | never-crash lints on 27 of 27 crates; panic_hunt present | | [Distribution](#distribution) | 4 | 4 | 3 | | -| [Open bugs](#open-bugs) | 6 | 3 | 23 | | +| [Open bugs](#open-bugs) | 12 | 3 | 17 | | ## Performance @@ -225,7 +225,7 @@ Never-crash attribute on 27 of 27 crate roots. | REL-1 | panic_hunt fuzzes every command with adversarial params | done | | engine/tests/panic_hunt.rs: every command, own thread, 4 s timeout; #[ignore], run in the gate | | REL-2 | Every workspace crate carries the never-crash deny(clippy::unwrap_used, ...) attribute | done | | Counted automatically above (crate roots under crates/ and apps/); testkit gained it in #221 | | REL-3 | The app catches escaped panics around command dispatch and import/export | partial | | engine lib.rs:336 dispatch; crash_guard.rs:21 import/export; the dispatch guard is untested | -| REL-4 | Atomic save (temp, fsync, rename) for every document write | missing | [#203](https://github.com/storytold/photocraft/issues/203) | Documents use fs::write in place; prefs/presets/bundles use tmp + rename without fsync | +| REL-4 | Atomic save (temp, fsync, rename) for every document write | done | [#203](https://github.com/storytold/photocraft/issues/203) | photocraft_format::atomic_write (format/src/atomic.rs, #230): same-dir temp, sync_all, rename with Windows PermissionDenied retry, Unix dir fsync; every document write site routes through it and format/src/atomic/tests.rs failure-injects write, rename and read-only-dir errors | | REL-212-1 | Fallible allocation for paste/erase/fill/transform/save/import, clear out-of-memory error | missing | [#212](https://github.com/storytold/photocraft/issues/212) | try_reserve only in io/flat.rs:221; codec max_alloc limits cover decode only | | REL-212-2 | Export switches to PSB when the estimated file size exceeds 2 GB | done | [#212](https://github.com/storytold/photocraft/issues/212) | PSD export uses checked size estimates for raster, masks, channels, and retained metadata | | REL-212-3 | Tests: an allocation-limit injection makes each command Err with the document unchanged | missing | [#212](https://github.com/storytold/photocraft/issues/212) | Only codec/raw max_alloc tests (codecs/tests/limits.rs:48) | @@ -250,12 +250,12 @@ Never-crash attribute on 27 of 27 crate roots. | Id | Target | Status | Issue | Note | |---|---|---|---|---| -| BUG-203-1 | Every document write goes through one atomic_write (temp, fsync, rename) | missing | [#203](https://github.com/storytold/photocraft/issues/203) | services.rs:125 std::fs::write; file_cmds.rs:91 fs::write; automation/files.rs:67 in place | -| BUG-203-2 | Temp file in the same dir, sync_all, rename over target, fsync dir on Unix | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No sync_all anywhere; services.rs:71 write_atomic (prefs only) does tmp + rename, no fsync | -| BUG-203-3 | Windows: retry the rename with backoff on PermissionDenied | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No retry around fs::rename (services.rs:77, preset_store.rs:189, format/store.rs:457) | -| BUG-203-4 | Unwritable directory errors clearly, never falls back to writing in place | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No atomic path exists for documents; all document writes are in place | -| BUG-203-5 | On any failure the original file is untouched and the temp file removed | missing | [#203](https://github.com/storytold/photocraft/issues/203) | services.rs:76 write_atomic leaves .tmp behind if rename fails; documents write in place | -| BUG-203-6 | Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No such tests under crates/ or apps/ | +| BUG-203-1 | Every document write goes through one atomic_write (temp, fsync, rename) | done | [#203](https://github.com/storytold/photocraft/issues/203) | photocraft_format::atomic_write (format/src/atomic.rs, #230/8227071); every write site routes through it: engine file_cmds.rs write_file and preset_store.rs, automation files.rs/headless.rs/workspace.rs, app services.rs write_atomic, format store.rs and autosave.rs | +| BUG-203-2 | Temp file in the same dir, sync_all, rename over target, fsync dir on Unix | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs: temp_name in the same dir, create_new + write_all + sync_all, Unix directory fsync after the rename | +| BUG-203-3 | Windows: retry the rename with backoff on PermissionDenied | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs RenameRetry::platform(): seven retries from 10 ms on Windows; retry_rename is shared with automation's cap-std workspace write | +| BUG-203-4 | Unwritable directory errors clearly, never falls back to writing in place | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs maps read-only dir, disk-full and cross-device rename errors to messages that say the original was not changed; there is no in-place fallback path | +| BUG-203-5 | On any failure the original file is untouched and the temp file removed | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs removes the temp file on every failure; tests assert the original bytes survive write and rename failures | +| BUG-203-6 | Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes | done | [#203](https://github.com/storytold/photocraft/issues/203) | format/src/atomic/tests.rs: Faulty AtomicFs injects mid-write StorageFull, rename failure and a read-only dir; locked-target retries, symlink and file-mode preservation covered too | | BUG-204-1 | Interface prefs (UI scale, font size, channels in colour, sliders, tooltips) wired or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | prefs.rs:196-202; no reader outside prefs.rs (see the prefs audit) | | BUG-204-2 | workspace.large_tabs, animated_zoom, auto_show_home_screen wired or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | prefs.rs:163,166,229; no reader outside prefs.rs | | BUG-204-3 | RAW prefs and ask_before_saving_layered_tiff read, or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | raw_defaults (prefs.rs:712), ask_before_saving_layered_tiff (prefs.rs:312) have no readers | diff --git a/scorecard/bugs.toml b/scorecard/bugs.toml index 696e512c..e1a9687a 100644 --- a/scorecard/bugs.toml +++ b/scorecard/bugs.toml @@ -1,6 +1,7 @@ # Scorecard checklist: open bugs (#203–#208). # Each item: id, short target, status (done | partial | missing), issue, note (evidence). -# Statuses must be true on main. Verified against 4b53f62 on 2026-10-05. +# Statuses must be true on main. BUG-203 verified against 47f9306 on 2026-10-07; the rest +# against 4b53f62 on 2026-10-05. area = "bugs" title = "Open bugs" order = 9 @@ -8,44 +9,44 @@ order = 9 [[item]] id = "BUG-203-1" target = "Every document write goes through one atomic_write (temp, fsync, rename)" -status = "missing" +status = "done" issue = 203 -note = "services.rs:125 std::fs::write; file_cmds.rs:91 fs::write; automation/files.rs:67 in place" +note = "photocraft_format::atomic_write (format/src/atomic.rs, #230/8227071); every write site routes through it: engine file_cmds.rs write_file and preset_store.rs, automation files.rs/headless.rs/workspace.rs, app services.rs write_atomic, format store.rs and autosave.rs" [[item]] id = "BUG-203-2" target = "Temp file in the same dir, sync_all, rename over target, fsync dir on Unix" -status = "missing" +status = "done" issue = 203 -note = "No sync_all anywhere; services.rs:71 write_atomic (prefs only) does tmp + rename, no fsync" +note = "atomic.rs: temp_name in the same dir, create_new + write_all + sync_all, Unix directory fsync after the rename" [[item]] id = "BUG-203-3" target = "Windows: retry the rename with backoff on PermissionDenied" -status = "missing" +status = "done" issue = 203 -note = "No retry around fs::rename (services.rs:77, preset_store.rs:189, format/store.rs:457)" +note = "atomic.rs RenameRetry::platform(): seven retries from 10 ms on Windows; retry_rename is shared with automation's cap-std workspace write" [[item]] id = "BUG-203-4" target = "Unwritable directory errors clearly, never falls back to writing in place" -status = "missing" +status = "done" issue = 203 -note = "No atomic path exists for documents; all document writes are in place" +note = "atomic.rs maps read-only dir, disk-full and cross-device rename errors to messages that say the original was not changed; there is no in-place fallback path" [[item]] id = "BUG-203-5" target = "On any failure the original file is untouched and the temp file removed" -status = "missing" +status = "done" issue = 203 -note = "services.rs:76 write_atomic leaves .tmp behind if rename fails; documents write in place" +note = "atomic.rs removes the temp file on every failure; tests assert the original bytes survive write and rename failures" [[item]] id = "BUG-203-6" target = "Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes" -status = "missing" +status = "done" issue = 203 -note = "No such tests under crates/ or apps/" +note = "format/src/atomic/tests.rs: Faulty AtomicFs injects mid-write StorageFull, rename failure and a read-only dir; locked-target retries, symlink and file-mode preservation covered too" [[item]] id = "BUG-204-1" diff --git a/scorecard/reliability.toml b/scorecard/reliability.toml index f4ca9704..f0ff269d 100644 --- a/scorecard/reliability.toml +++ b/scorecard/reliability.toml @@ -1,5 +1,6 @@ # Scorecard checklist: reliability (#212, #203, never-crash). -# Statuses must be true on main. Verified against 4b53f62 on 2026-10-05. +# Statuses must be true on main. REL-4 verified against 47f9306 on 2026-10-07; the rest +# against 4b53f62 on 2026-10-05. area = "reliability" title = "Reliability" order = 7 @@ -25,9 +26,9 @@ note = "engine lib.rs:336 dispatch; crash_guard.rs:21 import/export; the dispatc [[item]] id = "REL-4" target = "Atomic save (temp, fsync, rename) for every document write" -status = "missing" +status = "done" issue = 203 -note = "Documents use fs::write in place; prefs/presets/bundles use tmp + rename without fsync" +note = "photocraft_format::atomic_write (format/src/atomic.rs, #230): same-dir temp, sync_all, rename with Windows PermissionDenied retry, Unix dir fsync; every document write site routes through it and format/src/atomic/tests.rs failure-injects write, rename and read-only-dir errors" [[item]] id = "REL-212-1"