# DF-2633 — hammer2 write() silently succeeds while backend allocation fails on full PFS

ENOSPC never reaches the writer: `write(2)` keeps returning success (and
`fsync(2)` returns 0) while the backend flusher fails to allocate, floods
the console, wedges the mount (EBUSY forever), and the "successfully
written" data is silently lost.

## Reproduce (stock kernel)

    cc -O2 -o write2633 write2633.c
    cc -O2 -o phase2 phase2.c
    truncate -s 256M /tmp/h33.img
    vnconfig -c vn1 /tmp/h33.img
    newfs_hammer2 -L DATA /dev/vn1
    mkdir -p /mnt/h33 && mount_hammer2 /dev/vn1@DATA /mnt/h33
    mkdir -p ctrl
    ./write2633 /mnt/h33 ctrl 6000        # fill to the wall (~5 min)
    ./phase2 /mnt/h33 ctrl                # probe the wall state
    # console: unbounded "xop_strategy_write: error 32 loff=..." flood
    #         (325891+ lines, 213/s, never stops — see storm_measurements.txt)
    # umount:  EBUSY forever (umount_hang.attempt1.log)

Observed (stock, planD.log / stock_run.attempt1.log):

* fill reaches the wall: write() ENOSPC at block 3836-3841 — but the
  last ~8-9 MB of write()-SUCCESSFUL 64KB buffers fail asynchronously:
  134-137 distinct loffs stuck failing `xop_strategy_write: error 32`
  (HAMMER2 NOSPC) forever.
* `FILL_FSYNC rc=0 errno=0` — **fsync(2) returns 0 while its own data
  is failing at the backend** (POSIX violation), at 325k+ console errors.
* creates in the wall: 500/500 ENOSPC (pre-check catches them here).
* umount: `Resource temporarily unavailable` forever; `sync` hangs; the
  only escape from the wedged mount is a crash.
* crash + remount (media snapshot md5-verified while mounted+storming):
  **the filesystem recovers COMPLETELY EMPTY** — 251,658,240 bytes that
  write() returned success for and fsync() returned 0 for: 100% silent
  loss (postcrash_verify.log).  Control: healthy fs + sync + clean
  umount/remount roundtrips md5-identical (control_roundtrip.log).

## Fix validation (kernel #2 + fix.diff)

`validate_fix.sh` (+ fix_validation.log, fix_validation_roundtrip.log):

* at the wall: `FILL_FSYNC rc=-1 errno=28`, `APPEND_FSYNC rc=-1
  errno=28`, subsequent writes AND fsyncs all `-1 ENOSPC` (RETRY_* lines)
  — the deferred error now surfaces through write(2)/fsync(2);
* console: rate-limited to exactly 1 line/s (stock: 213+/s unbounded);
* healthy image: dd 1.1GB/s, md5 roundtrip MATCH, umount clean.

## Files

    write2633.c / phase2.c / verify2633.c      harness
    run_df2633.sh / run_planD.sh / validate_fix.sh
    stock_run.attempt1.log / planD.log / phase2_run2.log
    storm_measurements.txt     (console-storm + loss quantification)
    umount_hang.attempt1.log   (EBUSY-forever transcript)
    postcrash_verify.log       (recovered fs completely empty)
    control_roundtrip.log / control_healthy.log
    fix_validation.log / fix_validation_roundtrip.log
    fix.diff (shared DF-2632+DF-2633), VERDICT.md, verdict.json, manifest.json