fix(libretro): sync the save directory after the FDS rename

agy's review of #561 (the round after 5ddf520): the FDS save now fsyncs
its data before the rename, but a rename is a directory change, and
without syncing the directory the new entry may not survive a power loss.
The desktop's `write_atomic` already does this (`sync_parent_dir`), so the
libretro helper now matches it on Unix: open the parent, `sync_all`, and
treat EINVAL / ENOTSUP / EBADF as "this filesystem offers no directory
barrier" rather than a failure -- the same set, for the same reason (a
network mount must not fail every save on a path that fully succeeded).

Any other error is returned even though the file was replaced. Here that
only leaves the disk marked dirty, so the next flush writes it again; the
desktop documents the same trade-off at length in atomic_write.rs.

Not unit-tested, as with the data fsync: the failure it guards is a power
loss. libretro tests 38/38, clippy clean.

Answered on the PR without code: its BPS "integer overflow" is refuted at
patch.rs:400 (`length > target_size - out.len()`, a subtraction under the
invariant `out.len() <= target_size`); `rawset(mt, "__gc", f)` after
`setmetatable` is pinned as never honoured; the wasm heap is NF-09
(documented, piccolo 0.3.3 has no limit to set).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qfTKi2M3swo7qnwvYCkDj

Author: doublegate

crates/rustynes-libretro/src/lib.rs

@@ -1642,6 +1642,14 @@ fn fds_save_path(
 /// could leave an empty `.fds.sav` in place of the old one -- the outcome the
 /// temporary file exists to prevent. A failed write removes the temporary
 /// file rather than leaving it beside the save.
+///
+/// On Unix the parent directory is synced after the rename (agy on #561), as
+/// the desktop's `write_atomic` does: the rename is a directory change, and
+/// without it the new entry may not survive a power loss. A filesystem that
+/// does not offer a directory `fsync` (`EINVAL`, `ENOTSUP`, `EBADF`) is not a
+/// failure. Any other error is returned even though the file was replaced,
+/// which here only leaves the disk marked dirty, so the next flush writes it
+/// again.
 fn write_file_atomically(path: &std::path::Path, bytes: &[u8]) -> std::io::Result<()> {
     use std::io::Write as _;
     if let Some(dir) = path.parent() {
@@ -1660,7 +1668,26 @@ fn write_file_atomically(path: &std::path::Path, bytes: &[u8]) -> std::io::Resul
     }
     std::fs::rename(&tmp, path).inspect_err(|_| {
         let _ = std::fs::remove_file(&tmp);
-    })
+    })?;
+    #[cfg(unix)]
+    {
+        let dir = path
+            .parent()
+            .filter(|p| !p.as_os_str().is_empty())
+            .unwrap_or_else(|| std::path::Path::new("."));
+        match std::fs::File::open(dir).and_then(|d| d.sync_all()) {
+            Err(e)
+                if !matches!(
+                    e.kind(),
+                    std::io::ErrorKind::InvalidInput | std::io::ErrorKind::Unsupported
+                ) && e.raw_os_error() != Some(libc::EBADF) =>
+            {
+                return Err(e);
+            }
+            _ => {}
+        }
+    }
+    Ok(())
 }
 
 /// Hand the frontend the disk-control interface: the extended one (with

docs/audits/libretro-disposition.md

@@ -61,7 +61,7 @@ was shown red first and mutation-checked (commit bodies carry the evidence).
 | NL-10 | `retro_serialize` returned true for an undersized buffer | FIXED | Refused; `<` → `<=` fails 5 tests | v2.9.0 | `aff38af9` |
 | NL-05 | Core options not re-declared after deinit + re-init | FIXED | Declared from `on_set_environment` once per init cycle; red "left 1 right 2"; 2 mutations caught | v2.9.0 | `2619d9b2` |
 | NL-07 | Only the basic disk-control interface registered | FIXED | Extended interface when the frontend reports version >= 1, basic otherwise; the core's own `disk_image_label` null-checks, bounds, truncates and NUL-terminates, so L-1.5 stays unreachable. `set_initial_image` / `get_image_path` deliberately NULL (an FDS game must boot from side A). 3 mutations caught | v2.9.0 | `f22ae711` |
-| NL-03 | FDS disk writes never persisted | FIXED | Written to `<save>/RustyNES/<sha256>.fds.sav` -- the desktop's name and bytes, so a save moves between them -- atomically 60 frames after the disk is dirtied, and at unload / deinit / next load; read before the console is built. Tested with a synthetic BIOS that writes through `$4023/$4024/$4025`. No save directory means no disk save, and the core logs it. The temporary file is `sync_all`ed before the rename and removed on a failed write (agy on #561) | v2.9.0 | `af78b72a` |
+| NL-03 | FDS disk writes never persisted | FIXED | Written to `<save>/RustyNES/<sha256>.fds.sav` -- the desktop's name and bytes, so a save moves between them -- atomically 60 frames after the disk is dirtied, and at unload / deinit / next load; read before the console is built. Tested with a synthetic BIOS that writes through `$4023/$4024/$4025`. No save directory means no disk save, and the core logs it. The temporary file is `sync_all`ed before the rename and removed on a failed write, and on Unix the directory is synced after it, as the desktop's `write_atomic` does (agy on #561) | v2.9.0 | `af78b72a` |
 | NL-08 | Vs. System: no coin/service/DIP input, wrong palette | FIXED (DIP user setting DECLINED for now) | The Vs. database's PPU type and DIP default applied at load to both consoles of a cabinet; RetroPad L = coin (3-frame pulse, as the desktop), R = service, named in the input descriptors while a Vs. game is loaded. A local-only test shows the presented frame equals the palette-applied oracle for *Stroke & Match Golf (VS)*. User-set DIP switches as a core option are not done (eight switches do not fit the legacy `SET_VARIABLES` form cleanly; written up in `advanced_features.md`) | v2.9.0 | `02508296` |
 | NL-04 | `.info` said `core_options = "false"`; stale description | FIXED (local) | Local `.info` only; the audit now derives `core_options`, `disk_control`, `memory_descriptors` and `input_descriptors` from the source and rejects the retired scheduler wording. Upstream at v3.0.0 (ADR 0041) | v2.9.0 | `d32b2abd` |
 | NL-09 | Dual-cabinet save states slow and allocating | RECORDED, not changed | Two independent runs, same sign in 12 of 12 rounds: dual `snapshot()` 314-1,630 us against 46-78 us for a pooled candidate. `ab_check.sh` judges only the `full_frame` workloads, so it cannot rule on a serialize change; the fix belongs in `VsDualSystem` beside the NC-03 restore work. `architecture.md`'s "does not allocate" corrected | v2.9.1 | `1aee5565` |