Review round 1 on PR #165:
- ReadRegularMax checked the size on the opened handle, then read with an
unbounded io.ReadAll, so a file growing after the check returned past the
limit. The read now goes through io.LimitReader(max+1). A test seam grows
the file between the check and the read and counts bytes consumed.
- New: ReadScoped returns ErrTooLarge for a note over maxNoteBytes; red if
readContained drops the limit.
- notes.Target carries the brain root instead of deriving it by TrimSuffix.
- Rule 9: reader tests renamed to <Reader>RefusesSymlinksAndSurvivesSwapRaces;
ReadNote test has a positive control; brainfstest comment states what the
harness observes and what it does not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Option 1 of #157, slice 2. readExcerpt (brain_context), api.ReadNote
(brain_get / read-after-write) and notes.ReadScoped (brain_read) read
the Syncthing-shared brain by path. Under a symlink swap race each
leaked an outside file hundreds of thousands of times in 1.5s, including
brain_read, whose Lstat check was raced by the reopen-by-name; a FIFO
blocked os.ReadFile.
- All three read through brainfs (os.Root, regular files only,
non-blocking open, type check on the handle).
- brainfs.ReadRegularMax checks a size limit on the opened handle;
notes keeps its ErrTooLarge.
- New internal/brainfs/brainfstest: the shared swap-race harness
(symlink and held-writer FIFO swappers, awaited before TempDir
cleanup; AssertNoLeak / AssertNoHang) for this and later slices.
Tests red first: each reader under a symlink-swap race and a held-writer
FIFO race, plus static checks. Flipped: readExcerpt back to os.ReadFile
is red.
Refs #157
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>