Module scan 

The barrier’s scan-diff (plan §2.1 step 2).

A full walk against the PERSISTED baseline — never a re-seeded bucket manifest. Deletion basis: a path is delete-eligible only if it is absent in THIS scan AND was absent in the PREVIOUS scan AND is present in our own baseline (two-consecutive-scans: the rename-vs-walk race guard — a directory renamed mid-walk can appear in neither pass of one readdir, and that must never read as mass deletion).

Structs

ChangeStamp

The stamp no agent can set: a file’s ctime, which every write, chmod, rename and utimensat moves to now, and its inode. mtime is the agent’s to set (touch -d, cp -p, rsync -t): a same-size rewrite under the recorded mtime left size and mtime as recorded, and was never published (AGENTS.md forbade setting timestamps for that reason). An entry whose change stamp moved while size, mtime and mode did not is UNSURE: its bytes decide (confirm_racy, barrier::local_dirty), so a stamp that moved with no change costs a hash, never an upload. The model’s StampMoved, CtimeConfirm (LeanScanRacy.tla).

Classified

Scan

What a walk found: every regular file it could stat, and every path it was refused (held).

ScanEntry

Vouched

What a hash that vouched for an unsure entry leaves in its baseline entry (confirm_racy): the change stamp the scan saw, and whether the entry is still racy, measured now from its later stamp.

Enums

Hold

What a held path stands for: which keys it makes unseen rather than absent (Scan::holds, Scan::present).

NameError

What an error on one name says about that name. Every look a barrier takes at the tree by name (the walk’s stat and its open of a directory, the upload’s open, the confirmation of an absence) sorts its error by this one rule, so an error about one name decides that name, and only an error about none of them fails the barrier (L-144). Before it, each call site kept its own list, and any errno not on it, ENOENT among them, failed the whole barrier: a tree in which anything made and removed files stopped publishing for as long as it did.

Constants

PERM_BITS

The bits of st_mode a mode change can move and a checkout restores: permissions, setuid/setgid and sticky, never the file type.

RACY_WINDOW_NANOS

RACY CLEAN (git’s rule, racy-git.txt). A file’s mtime comes from a coarse kernel clock (a few milliseconds a tick), so two same-size writes inside one tick leave identical stat. A baseline entry whose bytes were read within a tick of the file’s mtime cannot vouch for the content: a second write in that tick, after the read, is invisible to stat_changed until the file changes again — if it never does, that write is never published. Such an entry is recorded racy and is believed only after its content hash agrees (confirm_racy, barrier::local_dirty). Two seconds covers every clock this runs on, coarse-second filesystems included.

TMP_SUFFIX

The consume’s temp sibling (safefs): a crash between its create and its rename leaves it as a regular file in the tree, and the scan used to publish it as data (review 2026-09-12, atomicity-7).

Functions

classify

confirm_racy

The unsure half of classify: an entry whose stat is unchanged but cannot vouch for its bytes (recorded racy, or its change stamp moved: stamp_moved) is hashed, and is an upload if its bytes are not the ones the baseline integrated (or cannot be read to tell). Returns the unsure entries the hash vouched for, each with the stamp to record and whether it is still racy; the caller writes the ones that changed. Run after classify, before anything trusts it. The model’s Confirm.

default_threads

Threads the walk uses unless told otherwise: the CPUs this process may use (the cgroup’s quota and the affinity mask count), at most 8.

is_control_path

Legacy citations under the reserved control namespace (boundary-verbs plan D0.2). A workspace that legally published files/.flint/... under a pre-D0 syncer has those paths in its baseline; the new scan skips them, so two consecutive scans would classify them absent and publish their DELETION. An upgrade must never delete data: they are carried forward frozen — never re-uploaded, never deleted by us.

later

The stamp the racy window is measured from: the LATER of mtime and ctime. Measured from an mtime the agent set into the past, a second same-size cp -p inside the tick of the first hid (the model’s RacyOnChange).

may_read

Whether the syncer may read the file at rel: false only when the kernel answers EACCES or EPERM. Asked of each upload before the barrier’s idle check, so a file it may not read is held there and an otherwise idle tick stays idle; upload_one holds one that turns unreadable after this. The syncer’s real and effective uids are one, so access is the open’s answer.

mode_differs

Whether two modes differ in PERM_BITS. Never off unix, where the walk reports a constant and a cited mode could never be matched.

name_error

now_nanos

racy

Whether a stat with this mtime, observed at at_nanos, is racy.

racy_entry

Whether a baseline entry is racy measured at at (racy, from its later stamp). An entry recorded without sub-second mtime takes the end of its second.

scan

Walk the workspace. Skips the state dir, the control namespace and symlinks (v1 non-goal, as the tier manifest’s).

scan_with

scan, by threads workers (lever E). They take directories from one queue, so a tree that is one huge directory and a tree of thousands of small ones both spread. Each entry is stat’ed relative to its directory’s descriptor, not by its full path (read_dir_entries). What it returns is what the one-thread walk returned: the same entries under the same exclusions, and the first error any worker meets fails the whole walk (Queue::failed), never dropped with the worker that met it. One worker walks on the calling thread. What it holds is the same set at any thread count.

stamp_moved

Whether b’s change stamp is not now’s. None, a baseline entry written before the stamp, compares as unknown, as stat_changed’s optional fields do.

stat_changed

Whether a file’s stat differs from its baseline stamp. Size and seconds always; nanoseconds and permission bits only when the baseline recorded them — a baseline written before either was stamped has None, and comparing against a missing value would re-upload every file once. The permission bits are here because a chmod moves only ctime: without them chmod +x was never published, and no checkout ever saw it. mode is the full st_mode.