scorecard: BUG-203 (atomic saves) is done - flip the stale rows (#203) (#687)

The BUG-203-1..6 and REL-4 rows still say missing, but the atomic-save work landed in #230 (8227071, 2026-10-05) - apparently after the 4b53f62 snapshot these statuses were verified against. Re-verified against the current tree: - one shared photocraft_format::atomic_write (same-dir temp, create_new + write_all + sync_all, rename, Unix directory fsync, Windows PermissionDenied rename retry with backoff), and every document write site routes through it (engine file_cmds/preset_store, automation files/headless/workspace, app services, format store/autosave); - no in-place fallback exists; read-only dir, disk-full and cross-device errors name the cause and state the original was not changed; - format/src/atomic/tests.rs failure-injects mid-write, rename and read-only-dir errors (11 tests; re-run for this change: green). The regenerated docs/scorecard.md moves Reliability to 4/1/2 and Open bugs to 12/3/17. No code changes.
2026-10-14 19:26:51 -04:00 · 2026-10-07 15:49:13 -04:00
1 parent 09f21d99ca
commit fc00f1e5bc
@@ -12,9 +12,9 @@ Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.js
 | [Workspace and UI](#workspace-and-ui) | 0 | 5 | 18 | settings that do nothing: 60 of 135 (target 0) |
 | [Type](#type) | 0 | 3 | 6 |  |
 | [Automation](#automation) | 1 | 3 | 7 | 626 of 626 menu items live (100.0%) |
-| [Reliability](#reliability) | 3 | 1 | 3 | never-crash lints on 27 of 27 crates; panic_hunt present |
+| [Reliability](#reliability) | 4 | 1 | 2 | never-crash lints on 27 of 27 crates; panic_hunt present |
 | [Distribution](#distribution) | 4 | 4 | 3 |  |
-| [Open bugs](#open-bugs) | 6 | 3 | 23 |  |
+| [Open bugs](#open-bugs) | 12 | 3 | 17 |  |

 ## Performance

@@ -225,7 +225,7 @@ Never-crash attribute on 27 of 27 crate roots.
 | REL-1 | panic_hunt fuzzes every command with adversarial params | done |  | engine/tests/panic_hunt.rs: every command, own thread, 4 s timeout; #[ignore], run in the gate |
 | REL-2 | Every workspace crate carries the never-crash deny(clippy::unwrap_used, ...) attribute | done |  | Counted automatically above (crate roots under crates/ and apps/); testkit gained it in #221 |
 | REL-3 | The app catches escaped panics around command dispatch and import/export | partial |  | engine lib.rs:336 dispatch; crash_guard.rs:21 import/export; the dispatch guard is untested |
-| REL-4 | Atomic save (temp, fsync, rename) for every document write | missing | [#203](https://github.com/storytold/photocraft/issues/203) | Documents use fs::write in place; prefs/presets/bundles use tmp + rename without fsync |
+| REL-4 | Atomic save (temp, fsync, rename) for every document write | done | [#203](https://github.com/storytold/photocraft/issues/203) | photocraft_format::atomic_write (format/src/atomic.rs, #230): same-dir temp, sync_all, rename with Windows PermissionDenied retry, Unix dir fsync; every document write site routes through it and format/src/atomic/tests.rs failure-injects write, rename and read-only-dir errors |
 | REL-212-1 | Fallible allocation for paste/erase/fill/transform/save/import, clear out-of-memory error | missing | [#212](https://github.com/storytold/photocraft/issues/212) | try_reserve only in io/flat.rs:221; codec max_alloc limits cover decode only |
 | REL-212-2 | Export switches to PSB when the estimated file size exceeds 2 GB | done | [#212](https://github.com/storytold/photocraft/issues/212) | PSD export uses checked size estimates for raster, masks, channels, and retained metadata |
 | REL-212-3 | Tests: an allocation-limit injection makes each command Err with the document unchanged | missing | [#212](https://github.com/storytold/photocraft/issues/212) | Only codec/raw max_alloc tests (codecs/tests/limits.rs:48) |
@@ -250,12 +250,12 @@ Never-crash attribute on 27 of 27 crate roots.

 | Id | Target | Status | Issue | Note |
 |---|---|---|---|---|
-| BUG-203-1 | Every document write goes through one atomic_write (temp, fsync, rename) | missing | [#203](https://github.com/storytold/photocraft/issues/203) | services.rs:125 std::fs::write; file_cmds.rs:91 fs::write; automation/files.rs:67 in place |
-| BUG-203-2 | Temp file in the same dir, sync_all, rename over target, fsync dir on Unix | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No sync_all anywhere; services.rs:71 write_atomic (prefs only) does tmp + rename, no fsync |
-| BUG-203-3 | Windows: retry the rename with backoff on PermissionDenied | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No retry around fs::rename (services.rs:77, preset_store.rs:189, format/store.rs:457) |
-| BUG-203-4 | Unwritable directory errors clearly, never falls back to writing in place | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No atomic path exists for documents; all document writes are in place |
-| BUG-203-5 | On any failure the original file is untouched and the temp file removed | missing | [#203](https://github.com/storytold/photocraft/issues/203) | services.rs:76 write_atomic leaves .tmp behind if rename fails; documents write in place |
-| BUG-203-6 | Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes | missing | [#203](https://github.com/storytold/photocraft/issues/203) | No such tests under crates/ or apps/ |
+| BUG-203-1 | Every document write goes through one atomic_write (temp, fsync, rename) | done | [#203](https://github.com/storytold/photocraft/issues/203) | photocraft_format::atomic_write (format/src/atomic.rs, #230/8227071); every write site routes through it: engine file_cmds.rs write_file and preset_store.rs, automation files.rs/headless.rs/workspace.rs, app services.rs write_atomic, format store.rs and autosave.rs |
+| BUG-203-2 | Temp file in the same dir, sync_all, rename over target, fsync dir on Unix | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs: temp_name in the same dir, create_new + write_all + sync_all, Unix directory fsync after the rename |
+| BUG-203-3 | Windows: retry the rename with backoff on PermissionDenied | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs RenameRetry::platform(): seven retries from 10 ms on Windows; retry_rename is shared with automation's cap-std workspace write |
+| BUG-203-4 | Unwritable directory errors clearly, never falls back to writing in place | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs maps read-only dir, disk-full and cross-device rename errors to messages that say the original was not changed; there is no in-place fallback path |
+| BUG-203-5 | On any failure the original file is untouched and the temp file removed | done | [#203](https://github.com/storytold/photocraft/issues/203) | atomic.rs removes the temp file on every failure; tests assert the original bytes survive write and rename failures |
+| BUG-203-6 | Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes | done | [#203](https://github.com/storytold/photocraft/issues/203) | format/src/atomic/tests.rs: Faulty AtomicFs injects mid-write StorageFull, rename failure and a read-only dir; locked-target retries, symlink and file-mode preservation covered too |
 | BUG-204-1 | Interface prefs (UI scale, font size, channels in colour, sliders, tooltips) wired or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | prefs.rs:196-202; no reader outside prefs.rs (see the prefs audit) |
 | BUG-204-2 | workspace.large_tabs, animated_zoom, auto_show_home_screen wired or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | prefs.rs:163,166,229; no reader outside prefs.rs |
 | BUG-204-3 | RAW prefs and ask_before_saving_layered_tiff read, or hidden | missing | [#204](https://github.com/storytold/photocraft/issues/204) | raw_defaults (prefs.rs:712), ask_before_saving_layered_tiff (prefs.rs:312) have no readers |
@@ -1,6 +1,7 @@
 # Scorecard checklist: open bugs (#203–#208).
 # Each item: id, short target, status (done | partial | missing), issue, note (evidence).
-# Statuses must be true on main. Verified against 4b53f62 on 2026-10-05.
+# Statuses must be true on main. BUG-203 verified against 47f9306 on 2026-10-07; the rest
+# against 4b53f62 on 2026-10-05.
 area = "bugs"
 title = "Open bugs"
 order = 9
@@ -8,44 +9,44 @@ order = 9
 [[item]]
 id = "BUG-203-1"
 target = "Every document write goes through one atomic_write (temp, fsync, rename)"
-status = "missing"
+status = "done"
 issue = 203
-note = "services.rs:125 std::fs::write; file_cmds.rs:91 fs::write; automation/files.rs:67 in place"
+note = "photocraft_format::atomic_write (format/src/atomic.rs, #230/8227071); every write site routes through it: engine file_cmds.rs write_file and preset_store.rs, automation files.rs/headless.rs/workspace.rs, app services.rs write_atomic, format store.rs and autosave.rs"

 [[item]]
 id = "BUG-203-2"
 target = "Temp file in the same dir, sync_all, rename over target, fsync dir on Unix"
-status = "missing"
+status = "done"
 issue = 203
-note = "No sync_all anywhere; services.rs:71 write_atomic (prefs only) does tmp + rename, no fsync"
+note = "atomic.rs: temp_name in the same dir, create_new + write_all + sync_all, Unix directory fsync after the rename"

 [[item]]
 id = "BUG-203-3"
 target = "Windows: retry the rename with backoff on PermissionDenied"
-status = "missing"
+status = "done"
 issue = 203
-note = "No retry around fs::rename (services.rs:77, preset_store.rs:189, format/store.rs:457)"
+note = "atomic.rs RenameRetry::platform(): seven retries from 10 ms on Windows; retry_rename is shared with automation's cap-std workspace write"

 [[item]]
 id = "BUG-203-4"
 target = "Unwritable directory errors clearly, never falls back to writing in place"
-status = "missing"
+status = "done"
 issue = 203
-note = "No atomic path exists for documents; all document writes are in place"
+note = "atomic.rs maps read-only dir, disk-full and cross-device rename errors to messages that say the original was not changed; there is no in-place fallback path"

 [[item]]
 id = "BUG-203-5"
 target = "On any failure the original file is untouched and the temp file removed"
-status = "missing"
+status = "done"
 issue = 203
-note = "services.rs:76 write_atomic leaves .tmp behind if rename fails; documents write in place"
+note = "atomic.rs removes the temp file on every failure; tests assert the original bytes survive write and rename failures"

 [[item]]
 id = "BUG-203-6"
 target = "Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes"
-status = "missing"
+status = "done"
 issue = 203
-note = "No such tests under crates/ or apps/"
+note = "format/src/atomic/tests.rs: Faulty AtomicFs injects mid-write StorageFull, rename failure and a read-only dir; locked-target retries, symlink and file-mode preservation covered too"

 [[item]]
 id = "BUG-204-1"
@@ -1,5 +1,6 @@
 # Scorecard checklist: reliability (#212, #203, never-crash).
-# Statuses must be true on main. Verified against 4b53f62 on 2026-10-05.
+# Statuses must be true on main. REL-4 verified against 47f9306 on 2026-10-07; the rest
+# against 4b53f62 on 2026-10-05.
 area = "reliability"
 title = "Reliability"
 order = 7
@@ -25,9 +26,9 @@ note = "engine lib.rs:336 dispatch; crash_guard.rs:21 import/export; the dispatc
 [[item]]
 id = "REL-4"
 target = "Atomic save (temp, fsync, rename) for every document write"
-status = "missing"
+status = "done"
 issue = 203
-note = "Documents use fs::write in place; prefs/presets/bundles use tmp + rename without fsync"
+note = "photocraft_format::atomic_write (format/src/atomic.rs, #230): same-dir temp, sync_all, rename with Windows PermissionDenied retry, Unix dir fsync; every document write site routes through it and format/src/atomic/tests.rs failure-injects write, rename and read-only-dir errors"

 [[item]]
 id = "REL-212-1"