[nissa-seru]

The workspace's disk reads no longer read through a mount root that isn't the mount's directory, readBinaryFromDisk's maxBytes bounds the read itself, and two more opens no longer wait on a FIFO.

Problem

openContainedFile is the contained read behind readFileFromDisk, readBinaryFromDisk and read_image. It checks containment against the mount root's realpath, taken during the read. So it checks that the file is inside whatever directory the root's path names at that moment, and nothing about which directory that is.

• A mount root replaced by a link elsewhere, or by another directory, was read as the mount. On main, with the root's identity recorded, I renamed the mount's directory away and put a link to another directory at its path. All three readers then returned that directory's files, while ls on the same mount reported its root as "not the directory disk last agreed with". The same happened with another directory put at the root's path, as an unmounted drive's mountpoint would be.
• A root that is gone, or is a file, was reported as a missing file. The read looks up the file before it resolves the root, so it answered "File not found" (ENOENT or ENOTDIR), though nothing is known about the mount's files then.

Since #468, readBinaryFromDisk reads through openContainedFile, with its maxBytes checked against the open's fstat. It then reads with handle.readFile(), which reads the file as it is by then. So a file that grew past maxBytes after that check came back whole. On main, with maxBytes 1024, a 100-byte file grown by 4000 bytes after the check came back as 4100 bytes, all of them loaded.

Two opens still waited on a FIFO, as the contained read did before #468:

• A directory's sync after a push (CheckedDir.sync()) opened the directory with 'r'. A FIFO put at its path once it was checked held that open, and with it the mount's turn, until something opened the FIFO for writing.
• The tool presentation file's read (ToolPresentation.read) opened the operator's path with openSync(path, 'r'), before its regular-file check. The read is synchronous, so a FIFO there held the whole process.

These cases take access beyond the workspace's own tools, such as a shell in the mount, write access to the mount's parent directory, or the operator's own configuration.

Changes

• openContainedFile checks the mount root first (readRoot), before any of its steps beneath it, as a pass checks it, through observe.ts's checkRoot.
  • Once the workspace has recorded the root's identity, a root that is any other directory is refused as mount_unavailable with no errno, at a new stage, 'root', in the words ls and sync give it. Those say to reconnect it, or to sync with acceptRoot if it was replaced on purpose.
  • A root that is gone is mount_unavailable with ENOENT, at stage realpath_root. One that is a file is mount_unavailable with ENOTDIR, at stage root. checkRoot gives only a reason, so a refusal for anything but another directory takes its errno from a stat of the root (rootAbsence).
  • The read takes the identity held in memory (DiskAgreement.rootIdentityForRead), in every state of the evidence's journal: the last identity whose append succeeded. So while the workspace's disk evidence awaits reopening, which is after an append to it failed and until the store is reopened, the read still checks the root, though passes and tool calls fail, as before. A mount whose first identity record is the append that failed is read as one with no recorded identity, as before that record.
  • Memory answers only once it's whole. A rebuild of it from the journal fills a new map and swaps it in at its end, so one that fails leaves the state before it. Until the store's open has read the evidence back in full, the evidence refuses everything, reads included, as mount_unavailable with that reason, and with the root's errno where no directory is there.
  • The path's parsing (parseFilePath), which each reader does before openContainedFile, also looks at disk. It takes disk's spelling of the path's names, and in a mount with nested mounts, it refuses a path that reaches one of them through a link (fix(workspace): a nested mount is its directory wherever disk puts it #535). So, by our reading, under a root replaced by a directory holding such a link, a path through the link is refused by that check rather than as replaced.
• While the read runs, the checked root is asked again (stillHere(), as an effect asks it in effects.ts's moved()). That happens once the file is open and its own checks pass, and before any refusal beneath the root, a missing file included, is reported. A root that is no longer the directory the read checked gets the code and errno its state would get before the read (rootMoved). The bytes are then read through the descriptor of the file that was checked, so a root that moves after that can't change what is read.
• read_image passes on a mount_unavailable refusal's message, as it does an escape's, where it said only "Mount unavailable: ".
• readBinaryFromDisk reads with readPrefix when given maxBytes, as readFileFromDisk and read_image do. A file it finds past maxBytes is refused as "File too large". The size it gives comes from an fstat after the read, and is at least one more than the bytes it kept, so it's always past maxBytes.
• CheckedDir.sync() and ToolPresentation.read open with O_RDONLY | O_NONBLOCK. A FIFO opens at once, and their existing checks refuse it: the sync's as a directory that changed since it was checked, and the presentation read's as a file that isn't regular, with a diagnostic and none of its settings applied.
• viewOf() builds a mount's view once, for a pass's runtime and for the read's root check.
• Doc comments and a changelog fragment.

What each part is for

• readRoot before the lookups puts the root's answer ahead of anything openContainedFile says about a path beneath it. Checking only after the open would still report a missing file under a root that isn't the mount's.
• checkRoot with the recorded identity is the one check the passes and effects already make, so the read and the evidence agree on which directory the mount is. Checking only that the root is a directory would read another directory as the mount.
• rootAbsence gives a host the errno that says no directory is there. By our reading, connectome-host's upload reads mount_unavailable with ENOENT or ENOTDIR as no file on disk.
• stillHere() after the open, and the one catch around the steps beneath the root, cover a root that changes during the read. Containment compares paths, so it can't see that by itself. One catch, rather than a check at each refusal, covers every refusal beneath the root, now and as steps are added.
• rootMoved classifies a root that moved mid-read as rootAbsence classifies one before the read, so one state gets one code and errno whatever the timing.
• rootIdentityForRead keeps each read checked, and host reads working, while the evidence awaits reopening. The evidence layer stops reading then so that a decision from stale evidence can't record what reopening contradicts, and a read records nothing. Refusing the read instead would turn a rare journal failure into an outage of every host read, a host's instructions file included, and reading without the check would follow a replaced root then. It needs no reconcile, since root entries are written without a sync, so a reconcile can't change the identity.
• A whole memory, the rebuilt map swapped in at its end and the evidence refusing everything until the open's rebuild has finished, is what makes the identity in memory one a read can check against. A partial rebuild would leave mounts with no identity, read unchecked. Nothing in the workspace reaches a failed rebuild after the open today, since it opens each agreement once, so the swap is a backstop. It keeps that rule in rebuild() itself, rather than in how rebuild() happens to be called.
• The catch around the identity's read keeps the read's refusals WorkspaceReadErrors, as its callers expect, when the evidence was never read back whole, and gives the root's errno where no directory is there.
• read_image's reason tells the agent why the mount is unavailable, which is what makes acceptRoot reachable.
• readPrefix in readBinaryFromDisk is the bounded read the other two readers share. The fstat after a truncated read, floored at the bytes found plus one, keeps the refusal's size truthful when the file changes again.
• O_NONBLOCK at the two opens turns a wait on a writer into the refusal each already makes.
• viewOf() keeps the view the read checks against identical to a pass's.
• The tests each fail without the piece they pin (Tests).

Nothing was cut.

What a host notices

At the mount root	Before	Now
Another directory, once the root's identity is recorded	read through it	mount_unavailable, no errno, stage root, "…not the directory disk last agreed with…"
Gone	not_found, ENOENT	mount_unavailable, ENOENT, stage realpath_root
A file	not_found, ENOTDIR	mount_unavailable, ENOTDIR, stage root

A root that goes, becomes a file or becomes another directory during the read, until the file has been opened and checked, gets the table's code and errno for that state, in any mount, recorded or not. Its stage and words name the check that found it.

readBinaryFromDisk answers a mount_unavailable refusal with the refusal's message as its error. So for a gone mount directory, or a file in its place, it now says "Mount unavailable: …", where it said "File not found on disk: ". With maxBytes, a file that grows past it during the read is refused as "File too large", where it was returned whole.

By our reading, connectome-host's upload (diskHasNoFile in its src/modules/identity-module.ts) reads mount_unavailable with ENOENT or ENOTDIR as no file on disk, as it reads not_found with ENOENT or ENOTDIR. So its outcomes for a gone directory and for a file in its place stay as they are. For another directory at the root, it now refuses the upload, where it uploaded that directory's file.

By our reading, connectome-host's web UI answers a mount_unavailable refusal with 503 and the others it doesn't forbid with 404 (src/modules/web-ui-module.ts). So for a gone mount directory, or a file in its place, its file route goes from 404 to 503, and for another directory at a recorded root, from 200, with that directory's file, to 503.

When a sync with acceptRoot fails at its append to the evidence, that sync fails, and reads go on checking against the identity from before it. So they refuse the root it was to accept, as before that sync, at least until the store is reopened, as at the next start.

Tests

At this head, which merges main 19fc2468 into this change's commit, on Linux, Node 24.22.0, with membrane 0.5.87, context-manager 0.14.1 and chronicle 0.4.0 installed (the repository commits no lockfile). The pull request's CI runs the whole suite on Node 20 and 24, on Ubuntu and macOS.

• The touched test files pass: test/workspace-read-file-from-disk.test.ts 46 of 46, test/workspace-three-way.test.ts 354 of 354 and test/tool-presentation.test.ts 14 of 14.
• New, in test/workspace-read-file-from-disk.test.ts:
  • A root that is a link to a directory outside the mount, and one that is another directory at the root's path, each once the identity is recorded, are refused by all three readers, a path the replacement lacks included. After sync with acceptRoot, the read goes through.
  • A root replaced by another directory between its check and the open is refused, not read.
  • A gone root and a root that is a file are mount_unavailable with ENOENT and ENOTDIR, and readBinaryFromDisk answers each with the refusal's message.
  • A root removed, replaced by a file, replaced by another directory, or replaced by another directory holding the file, at each of three moments in the read, is refused with the code and errno the root's first check gives that state. The moments are just before the file is looked up, between the open and the file's recheck, and once the file is open.
  • A mount configured through a link that is re-pointed to another directory at each of those three moments, as a blue-green deploy swaps one, is refused as replaced, with no errno, though the directory the read checked is untouched.
  • A mount with no recorded identity whose root is replaced mid-read is refused, with no errno.
  • While the disk evidence awaits reopening after an injected append failure, a read of the mount's own file goes on, and one through another directory put at the root is refused.
  • A sync with acceptRoot whose append fails, by injection, leaves reads refusing the root it was to accept, against the identity from before.
  • A workspace whose open can't read the evidence back refuses reads as mount_unavailable, with ENOTDIR once a file is at the root.
  • A workspace whose open fails to record a mount whose directory changed refuses reads of every mount, the ones after it in its configuration included.
  • readBinaryFromDisk with maxBytes 100 refuses a file grown past it after the open, from 10 bytes and from empty, with the size the read found, having loaded at most 101 bytes. It refuses one that grew and then shrank before the size was taken as "101 > 100". It reads one that grows but stays within maxBytes whole.
  • The missing-file test now checks its errno too, ENOENT.
• New, in test/workspace-three-way.test.ts:
  • A FIFO put at a checked directory's path doesn't hold up its sync, which reports the directory as changed.
  • A rebuild of the evidence whose append fails partway, reached by opening the agreement again with a moved mount, leaves memory as it was: a mount after the failed append keeps its identity.
• New, in test/tool-presentation.test.ts: a FIFO at the presentation file is refused with a diagnostic, and the default description stays. The read runs in a child process stopped at 10 s, since a read that waits holds the process it runs in.
• Red-first: with main's src/modules/workspace/index.ts, observe.ts and disk-agreement.ts, and its src/tool-presentation.ts, under these tests, 29 of the 30 new tests fail, and no other test. The one that passes is the growth within maxBytes, which main's whole read also returns whole.
• Removals: each of 20 pieces, taken out or put back as main has it alone, fails at least one new test, and no other test in the file that holds its tests. They are the root's check coming first, its recorded identity, the check after the open, the one catch, rootAbsence's ENOTDIR and its errno for a failed stat, rootMoved's classification, the read's use of rootIdentityForRead rather than rootIdentity, that accessor's answer while the evidence awaits reopening and its refusal while memory isn't whole, the evidence's refusal until the open has read it back in full, a rebuild's map swapped in at its end, the catch around the identity's read and that catch's errno, read_image's reason, the two non-blocking opens, and readBinaryFromDisk's bound, the fstat after its read, and that size's floor. Each ran at this head. Putting main's write() in the other order, applying before appending, fails the acceptRoot test.
• Typecheck and build are clean.

Not verified

• Windows. The tests that rename the mount's directory while a file in it is open are skipped there.

Out of scope

• A mount with no recorded identity yet is read under whatever directory its root names when the read starts, so a link put in place of its directory before the workspace has gathered any evidence there is still followed. Until then, the workspace has no root to compare with.
• A root replaced and put back between two checks isn't seen, as observe.ts's header says of every check by path.
• Opens of operator-configured paths that check nothing about what they open, such as the event gate's config (readFileSync), the operator log (appendFileSync) and the host-mode recovery directory's sync (openSync(directory, 'r')). Each opens whatever is at its path, so a FIFO there waits until its other end is opened. Refusing one would be a new refusal, and for some, such as a config fed through process substitution or a log another process reads, a pipe can be what the operator means. This change fixes only the opens that already refuse anything but a regular file or a directory, where the wait served nothing.

Companion PRs

• test(web-ui): the gone-mount files test answers as agent-framework's read does connectome-host#330, merged first. Before it, connectome-host's /files/ test for a mount whose directory has gone expected 0.22.2's 404, and it failed with this change. It now asks agent-framework's read first and expects the route to answer as the read does, so it passes on 0.22.2's read and on this change's (its Tests). With it in, this change can land on its own.

---

• Changelog fragment added: changelog.d/disk-read-root-and-fifos.fixed.md

Written by Rupert-2634 (Claude Opus 5.5), to a design Ada-1017 (Claude Opus 5.5) approved. Hilda-2580 (Claude Opus 5.5) found the replaced-root read and the FIFO hangs this work began with, and the unbounded maxBytes read whose last site this bounds. After a round of our internal review, Desmond-2579 and Duncan-2410 (Claude Opus 5.5) reviewed it. A rebase onto main changed only an import line, a second round of our internal review read every line since the first, and Desmond-2579 and Duncan-2410 approved its fixes. Duncan-2410 also read its merge of main after #535.

Description checked and posted by Fiona-2757 (Claude Opus 5.5).

🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's Pi tooling, and posted from the shared nissa-seru account.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Disk reads now check that a mount still names the expected directory.

• Workspace reads check the mount root before opening files.
• Binary reads stop at the byte limit even when files grow.
• Directory syncs and presentation reads no longer wait on FIFOs.

Acknowledged scope from nissa-seru: roots without a recorded identity still use the directory present when a read starts. Root swaps restored between checks remain undetected. Reads after a failed journal append deliberately use the last successfully recorded identity; a failed initial rebuild refuses reads until reopening. Other operator-configured opens are intentionally unchanged.

Review was based on source and test inspection. Tests were not run.

_{Reviews (1) · Last reviewed commit: "fix(workspace): disk reads check the mou..." · Reviewed by Greptile}