errors: a save that could not happen, and two panics on an ordinary click

A review of what this program does when the environment says no. The finding
that reframes it: there were almost NO panics on ordinary paths — the rule
already held — but there was a great deal of silence, and one case worse than
any panic.

SILENT DATA LOSS ON SAVE. `saveFile` marked the pane saved the moment it
QUEUED the effect, before any host had tried; `host_io.writeFd` returned void,
so a short or failed write was indistinguishable from a complete one; and
`writeFileBytes` returned true regardless. A save to a read-only file, or into
a directory removed under the pane, therefore cleared the tag's ` *` and posted
nothing — and `Del` makes no dirty check, so the next click threw the edits
away with the screen saying they were safe. On a full disk it was worse: the
file is already `O_TRUNC`'d when `write` fails, so the message row said `saved`
over a file that had just been emptied.

Now: `writeFd` reports, `writeFileBytes` returns WHY (`PermissionDenied`,
`NoSpaceLeft`, `ReadOnlyFilesystem`, …) including a failed `close`, which is
where write-back filesystems report at all; the core marks the pane saved
around `perform` rather than at emit, which is also where the bytes are read;
and a host that could not write calls `Pardes.saveFailed`, which puts the
reason on the message row and takes the clean mark back. That is a CALL and
not a return value because host.zig enforces, at comptime, that a `push_`
method reaching every host in a fan-out cannot have one answer — the first
attempt at this changed the signature and the compiler was right to refuse it.

TWO PANICS ON AN ORDINARY KEYSTROKE, in look.zig's number scans. `v = v * 10 +
d` over caller-supplied digits, reached from `parsePathLine` and the `@pN` scan
— which every Look, every right-click and every n/N motion runs on whatever
word is under the pointer. A hash in a log, a CSV column, any output shaped
`foo:99999999999999999999`, and the editor died with "integer overflow". Both
saturate now, the same way acmefs.zig's address parser already did; a saturated
line is refused by `file_pane.open`'s `line <= total` and a saturated pane id
by `focusPaneLine`'s `id < MAX_PANES`, so nothing addressable changes.

A BOOT FILE THAT WILL NOT OPEN joins the missing-name case in the `+Errors`
pane instead of taking the launch down: `pardes /root` resolves as a `.file`,
could not be read, and left `error: PermissionDenied` and a return trace.
`look.readFile` now says which errno it was, so the pane can say "permission
denied" rather than a word from the source code.

The tag-marker test drained no effects and passed anyway, which is exactly the
defect; it drains now.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_016Q4RATpafkwahrovHQLKRf

1 files changed, 4 insertions, 3 deletions

diff --git a/src/macos.zig b/src/macos.zig
index f2e68a85..9d4f6039 100644
--- a/src/macos.zig
+++ b/src/macos.zig
@@ -2238,7 +2238,7 @@ fn spawnShell(ctx: ?*anyopaque, pane: u8, cwd: []const u8) void {
 
 fn ptyWrite(ctx: ?*anyopaque, pane: u8, bytes: []const u8) void {
     const st = hostState(ctx);
-    if (st.ptys[pane]) |pt| host_io.writeFd(pt.file.handle, bytes);
+    if (st.ptys[pane]) |pt| _ = host_io.writeFd(pt.file.handle, bytes);
 }
 
 fn ptyResize(ctx: ?*anyopaque, pane: u8, cols: u16, rows: u16) void {
@@ -2271,7 +2271,8 @@ fn ttyTaken(ctx: ?*anyopaque, pane: u8) bool {
 /// resolved which path and which bytes.
 fn writeFile(ctx: ?*anyopaque, pane: u8, path: []const u8, bytes: []const u8) void {
     const st = hostState(ctx);
-    if (!host_io.writeFileBytes(path, bytes)) return;
+    host_io.writeFileBytes(path, bytes) catch |err|
+        return st.core.saveFailed(pane, "save", err);
     // The directory source will observe our own close. Move its baseline first
     // so that notification is a hash no-op instead of manufacturing an external
     // reload and undo boundary.
@@ -2286,7 +2287,7 @@ fn writeDump(ctx: ?*anyopaque, bytes: []const u8) void {
     const st = hostState(ctx);
     var pbuf: [1024:0]u8 = undefined;
     const path = pardes.dump.outPath(&pbuf) orelse return;
-    if (!host_io.writeFileBytes(path, bytes)) return;
+    host_io.writeFileBytes(path, bytes) catch |err| return st.core.reportError(0, "dump", err);
     st.core.setLastDump(path);
 }