* mount: fence a dropped handle only when it holds unpublished content
dirtyMetadata is also set by chmod, xattr and fallocate, so a failed
metadata-only close refused every later write of the inode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: fence the inode before its last handle leaves the handle map
A reopen between the map removal and the fence could publish at the
stale kernel EOF.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: fence a failed metadata flush only when the handle holds content
A refused synchronous flush or an abandoned writeback metadata flush of a
handle with only chmod, xattr or fallocate changes fenced the inode, so
later writes were refused until FORGET.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: count a size change on an open handle as unpublished content
A truncate or extend through an open handle changes the entry's size and
chunks, but it set only dirtyMetadata. A failed close then skipped the
final-release fence, so a reopen before FORGET could publish against the
untruncated entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: mark copied content dirty before each page of a streaming copy
A copy that failed or was cancelled after earlier pages were accepted left
dirtyContent false, so the final-release fence skipped that content.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: mark copied content dirty only after a page is accepted
A copy whose first page is rejected leaves the destination unchanged and
the kernel EOF where it was, so fencing the inode on release only blocked
later writes until FORGET.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: skip the server-side copy while the destination holds unpublished content
A whole-file server copy clears dirtyContent when it commits, so a page a
cancelled streaming copy left behind would lose its release fence. Fall
back to the streaming copy instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: skip the server-side copy while the source holds unpublished content
The filer copies the stored source, so pages still pending on the source
handle would be missing from the destination. The streaming copy reads
them through the dirty pages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: check the publication fence before a server-side whole-file copy
The filer copy publishes the destination without going through the
flush-time guard, so a fenced writeback inode could still take new
content before FORGET. Fall back to the streaming copy, whose flush is
guarded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* mount: guard append gaps over concurrent content merges
* mount: fence a writeback inode when its async publication is abandoned
A drain that gives up on a non-precondition error left the token clear, so a
reopened writeback handle could publish past the stored EOF.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: fence a writeback inode when its async data flush fails
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: fence the inode when its last handle drops uncommitted content
A synchronous release whose final flush fails destroys the handle's dirty
pages, while under writeback the kernel EOF already counts them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* mount: keep the filer status in the flush create error
flushMetadataToFiler formatted the CreateEntry error with %v, so callers
classifying it saw only the message, which includes the file path. Wrap
it so the gRPC status the filer sent stays reachable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: retry a writeback metadata flush until the filer answers
With -writebackCache, close() returns before the chunk references reach
the filer. The deferred flush gave up after four attempts, about a minute
once each attempt's own filer retries are counted, then released the
handle: a longer filer outage dropped the file even though write() and
close() had succeeded, and its uploaded chunks became orphans.
Keep retrying for as long as the filer is unreachable, as the writeback
chunk uploads already do. A filer that answers with an error still ends
the flush after the bounded attempts, and an unlink of the draining file
still ends it on the next attempt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* mount: retry only an unanswered filer call without a bound
The unbounded phase used util.IsTransientError, which falls back to
matching the error text. A refusal the filer sends in its response
(read-only, name too long, a plain error string) has no gRPC status, and
the flush error carries the file path, so a file named like
"unavailable-transport.log" kept retrying against a filer that answered.
Retry without a bound only when the call failed with a gRPC Unavailable
status: the dial, the connection or the mount's call deadline gave out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
