## Problem Two defects in the archive format, found in a full audit of the module. ### 1. A short write signs a truncated archive, and live-purge then deletes the rows `ArchiveEnvelope::writeNdjson()` and `appendArchiveRecordFooter()` call `fwrite()` and never read the return value; neither checks `fclose()` either. `fwrite()` does not raise on a full disk, a quota, or a stream that cannot take the whole buffer: it returns a byte count and lets the caller carry on. The consequences compound: 1. the file is silently truncated; 2. `$row_count` counts loop iterations, not bytes, so the caller sees the full count and records it on the segment; 3. `hash_file()` hashes the truncated file, and that digest becomes `file_sha256` and is signed into `archive_hmac`; 4. `applyLivePurge()` -> `assertArchiveFileMatchesDigest()` compares only that digest, matches, and DELETES the live rows. The rows are destroyed and the archive that replaced them is incomplete, with every signature valid. Nothing on the purge path compares the file's contents against `row_count`: `walkRowChain()` does exactly that and is only called from the import path, and `replayRows()` only from `archive-verify`. A stream buffers, so the close matters as much as the write: bytes an `fwrite()` accepted can still fail on the flush `fclose()` performs, and that was the last chance to hear about it. `ChainTimestamper` has the same miss in a smaller place: `writeTemporary()` did not check `file_put_contents()`, while `writeTempFile()` — a near-duplicate helper in the same class — did. An unchecked write there makes `openssl ts -verify` read an empty file and report a TSA failure that is really a disk failure. The two collapse into the one that checked. ### 2. `archive-verify` can report "row replay mismatch" on an intact archive `replayRows()` walked each archived line back to its live row with `WHERE chain = :c AND created = :us ORDER BY id LIMIT 1`, and the method's own docblock conceded the key is only "effectively unique". It is not a key: `created` is captured when the event happens rather than when it is chained, so two requests staging into the outbox can capture the same microsecond and both land on one chain. Both lines then resolve to the lower id, the second line's payload is hashed against the first row's stored hash, and an archive nobody touched reports as tampered — the false-tamper verdict this module exists to avoid. Every row envelope has carried its exact `id` since restore needed it (`buildEnvelopeRowLine()` writes it, `assertRestoreEnvelopeShape()` requires it), so the lookup can be a primary key, which also drops one SELECT per archived row. **That fix reopens the same defect one lifecycle step later, and the second commit closes it.** The post-purge skip used to fall out of the lookup: `resolveRowIdFromCreated()` answered NULL for a row that was gone, and that NULL is what made the replay skip it. An id always resolves, so after live-purge every archived row reached the comparison, found no stored hash, and reported a replay mismatch. The skip is now an explicit test on the stored hash being absent. ## Proposed resolution Refuse a short write and a failed close where they happen, collapse the two temp-file writers in `ChainTimestamper` into the one that already checked, address the live row by the id the envelope carries, and keep the post-purge skip explicit rather than incidental. ## Tests - `ArchiveEnvelopeShapeTest::testShortWriteIsRefused` — a handle that will not take the bytes is refused rather than truncating. Fails without the fix. - `ArchiveEnvelopeShapeTest::testFailedCloseArrivesAsAnOperatorMessage` — every way of failing to close leaves as an operator-readable refusal, which is what makes the writers' guard safe: they mark the handle closed before closing it, and closing an already-closed handle is a `TypeError` in PHP 8 that would replace the message an operator needs with one about resource types. - `ArchiveEnvelopeShapeTest::testTheFooterWriterRefusesWhenTheDeviceIsFull` and `ChainArchiverTest::testTheRowWriterRefusesWhenTheDeviceIsFull` — the two writers go *through* the guard, which is the half that was broken: three call sites ignored the byte count while a sibling three methods away had always checked it, so a writer that stops calling the guard puts the whole failure mode back. Driven against `/dev/full`, which accepts an open and tells every write there is no space left on the device: the condition out of the kernel rather than a stand-in, and both writers take their path as an argument so it needs no stream wrapper. The row-writer one also asserts the rows the archive was to replace are untouched. Skipped where the device does not exist. - `ChainArchiverTest::testArchiveVerifyHandlesRowsSharingOneCreatedTimestamp` — two rows sharing a `created` microsecond each replay against their own row. Fails without the fix (`row_replay.ok` FALSE on an intact archive). - `ChainArchiverTest::testArchiveVerifyStillPassesAfterLivePurge` — a purged range is skipped rather than called mismatched. Addressing the row by the id the envelope carries is what makes this test necessary: resolving by timestamp answered NULL for a purged row and the replay skipped it on that answer, whereas an id always resolves, so without an explicit skip the purged range reached the hash comparison and every one of its rows was reported as a replay mismatch. --- AI-Generated: Yes (Claude Code was used to audit the module, draft this issue summary, and write the code and tests on the merge request. Each new test was verified to fail without its fix and to pass with it, and phpcs, PHPStan, cspell and the module's kernel suite were run before pushing.)