# DF-2638 — hammer2_inode_chain_sync clears RESIZED/MODIFIED before the backend sync and never restores them on error

## What
sys/vfs/hammer2/hammer2_inode.c:1718-1733 (hammer2_inode_chain_sync):

```c
	atomic_clear_int(&ip->flags, HAMMER2_INODE_RESIZED |
					 HAMMER2_INODE_MODIFIED);
	hammer2_xop_start(&xop->head, &hammer2_inode_chain_sync_desc);
	error = hammer2_xop_collect(&xop->head, 0);
	hammer2_xop_retire(&xop->head, HAMMER2_XOPMASK_VOP);
	...
	if (error) {
		kprintf("hammer2: unable to fsync inode %p\n", ip);
		/*
		atomic_set_int(&ip->flags,
			       xop->ipflags & (HAMMER2_INODE_RESIZED |
					       HAMMER2_INODE_MODIFIED));
		*/
		/* XXX return error somehow? */
	}
```

The dirty flags are cleared *before* the backend xop runs; if the xop
fails (I/O error, ENOSPC-pressure conditions per DF-2633), the restore is
commented out and the error is swallowed.  Consequences: the in-memory
meta changes (size after truncate/extend, times, mode) are silently
dropped from the dirty state — the inode can go out of sync with its
chains/data, and a subsequent truncate that shrank the file can leave
meta.size stale relative to the data topology after remount
(data-integrity / silent-metadata-loss; the caller believes the sync
succeeded only partially because errno is 0 on the next call).

Reached from every hammer2 fsync/sync path (hammer2_inode_chain_sync is
called by vop_fsync and the syncer, hammer2_vfsops.c:2699).

## Trigger sketch
Fill a PFS to ENOSPC, truncate+fsync in a loop; backend chain_sync xop
fails; flags already cleared; meta.size desyncs from media.  Not
guest-verified this run (Low severity, speculative end-impact; skipped per
audit contract — see verdict.json).

## Fix
Restore the flags on error (uncomment and keep xop->ipflags) and
propagate the error:
```diff
 	if (error) {
-		kprintf("hammer2: unable to fsync inode %p\n", ip);
-		/*
 		atomic_set_int(&ip->flags,
 			       xop->ipflags & (HAMMER2_INODE_RESIZED |
 					       HAMMER2_INODE_MODIFIED));
-		*/
+		kprintf("hammer2: unable to fsync inode %ld\n",
+			(long)ip->meta.inum);
 	}
```