fix(node): atomic + fsync'd write_meta for crash-recovery sidecar

The recovery meta sidecar is the gate G11 source-of-truth for the
"converge to last fully-committed tip after kill -9" claim. Replace
std::fs::write with the standard write-tmp-then-rename idiom plus a
best-effort directory fsync, so a power loss between the byte-write
and the inode-write cannot leave the sidecar partially populated.

Op: correct
Restores: spec:G11 — crash recovery converges to last fully-committed tip

Author: metaphorics

crates/node/src/crash_recovery.rs

@@ -47,11 +47,36 @@ pub fn read_meta(state: &NodeState) -> Result<Option<Meta>> {
 
 /// Overwrites the recovery sidecar with `meta`.
 pub fn write_meta(state: &NodeState, meta: &Meta) -> Result<()> {
+    use std::io::Write as _;
+
     let path = meta_path(state);
+    let dir = path.parent().unwrap_or_else(|| std::path::Path::new("."));
+    let tmp = path.with_extension("json.tmp");
     let json = serde_json::to_vec_pretty(meta)
         .with_context(|| format!("encode recovery meta {}", path.display()))?;
-    std::fs::write(&path, json)
-        .with_context(|| format!("write recovery meta {}", path.display()))?;
+
+    {
+        let mut file = std::fs::OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .write(true)
+            .open(&tmp)
+            .with_context(|| format!("open tmp recovery meta {}", tmp.display()))?;
+        file.write_all(&json)
+            .with_context(|| format!("write tmp recovery meta {}", tmp.display()))?;
+        file.sync_all()
+            .with_context(|| format!("fsync tmp recovery meta {}", tmp.display()))?;
+    }
+
+    std::fs::rename(&tmp, &path)
+        .with_context(|| format!("atomic rename recovery meta {}", path.display()))?;
+    // Best-effort directory fsync. POSIX allows the rename to be re-ordered until
+    // the parent directory's inode is synced. Failing the fsync (e.g. on filesystems
+    // that don't support it) is non-fatal — the rename already happened.
+    if let Ok(dir_handle) = std::fs::File::open(dir) {
+        let _ = dir_handle.sync_all();
+    }
+
     Ok(())
 }
 

crates/node/tests/crash_recovery.rs

@@ -1,7 +1,7 @@
 //! Integration tests for the bitcoin-rs node.
 
 use anyhow::{Context as _, Result};
-use bitcoin_rs_node::{Config, Network, crash_recovery, state::NodeState};
+use bitcoin_rs_node::{crash_recovery, state::NodeState, Config, Network};
 
 #[test]
 fn recovery_replays_from_last_committed_height_to_tip() -> Result<()> {
@@ -28,3 +28,29 @@ fn recovery_replays_from_last_committed_height_to_tip() -> Result<()> {
     assert_eq!(restarted.replayed_heights(), vec![8, 9, 10]);
     Ok(())
 }
+
+#[test]
+fn recovery_meta_write_leaves_readable_sidecar_without_tmp() -> Result<()> {
+    let temp = tempfile::tempdir()?;
+    let mut config = Config::default_for_network(Network::Regtest);
+    config.data_dir = temp.path().join("node");
+    config.storage_backend = "redb".to_owned();
+    config.p2p_listen.clear();
+
+    let meta_path = config.data_dir.join("recovery_meta.json");
+    let tmp_path = config.data_dir.join("recovery_meta.json.tmp");
+    {
+        let state = NodeState::open(config)?;
+        state.record_synthetic_block_for_recovery(3)?;
+    }
+
+    assert!(meta_path.exists());
+    let bytes = std::fs::read(&meta_path)
+        .with_context(|| format!("read recovery metadata {}", meta_path.display()))?;
+    let meta: crash_recovery::Meta = serde_json::from_slice(&bytes)
+        .with_context(|| format!("parse recovery metadata {}", meta_path.display()))?;
+    assert_eq!(meta.height, 3);
+    assert_eq!(meta.last_committed_height, 3);
+    assert!(!tmp_path.exists());
+    Ok(())
+}