# DF-2765 — VERDICT

**Status: reproduced (first run), fix validated.**

## Baseline (stock kernel)
Journal installed on /tmp (tmpfs); rename of /tmp/jt/a/src.txt ->
/tmp/jt/b/dst.txt through the shim; stream decoded:

- RAW sid=0xc100 (JREC_STREAMCTL_BEGIN|END, streamid 0x100) = the
  JTYPE_RENAME transaction.
- PATH1 leaf (0x0402) @0x60  = "jt/b/dst.txt\0"
- PATH2 leaf|LAST (0x4403) @0x78 = "jt/b/dst.txt\0"
- "jt/a/src.txt" count in the whole 192-byte stream: **0**

Root cause: journal_nrewrite records both paths AFTER
vop_journal_operate_ap (vfs_jops.c:1322-1323); the underlying nrename
calls cache_rename (vfs_cache.c:2085) which relinks fnch->ncp to the
target name in-place (:2118-2120) and unlinks tnch->ncp (:2141). The
source path is thereby unobservable after the op.

## Fix (validated on kernel #2)
PATH1 written from ap->a_fnch->ncp between jreclist_init and the op
(hunk 4 of fix.diff). On op failure the whole stream is aborted by
jreclist_done(error), so the pre-op write is free. Post-fix stream:
source count 1, target count 1. run_fixed.log + journal_stream_fixed.bin.

## Impact
Journal-record correctness: replicas/mirrors replaying rename records
degenerate to rename(new,new) and silently diverge; reversable-journal
undo of renames is impossible. Requires a root-installed journal;
trigger is any rename on the journaled mount (unprivileged ok).
Severity Low.