Six FS modules landed in two commits, plus a security fix from Code review.
sigdb_query.sg — plan-based executor (28c0261)
sdq_exec_plan() dispatches a cc0 planner query plan over SigDB: SELECT point/range, INSERT, UPDATE (del+put atomic), DELETE. The plan-based dispatch means the cc0 SQL parser emits a typed plan; the executor validates and runs it without text re-parsing. Verified ISRUDP green.
fs_compress.sg — LZ4 + Zstd block compression (28c0261)
fsc_seal(data, len) → SG_block / fsc_open(block) → data. 8-byte SG header encodes codec (0=stored, 1=LZ4, 2=Zstd-flavored) + original length. Incompressible data is auto-stored uncompressed (codec=0) — no overhead on already-compressed payloads. Verified SORCU green.
fs_replication.sg — async CAS replication (28c0261)
State machine: fsr_pending → fsr_diff_next → fsr_push_object. Replicates object by CAS hash over Cap<NetConn> — the receiver checks the hash before accepting; duplicate objects are no-ops. Foundation for the SMB/NFS mirror path and the backup tier. Verified IMPDK green.
Security fix: fsc_lz4_decompress OOB read (4e552ff)
Finding by Sigil-Code (review). match_src = di - offset could yield a negative pointer on crafted input — an out-of-bounds read. Fix: if (offset > di) { return -1; } before the back-reference. Verified: crafted negative-offset input now returns error; no regression on valid LZ4 stream. Shipped in 4e552ff.
fs_quota.sg + fs_audit.sg + fs_snapshot.sg (721eaea)
Quota: cap-scoped byte ceiling per session; fq_enforce_write rejects at the limit. Audit: HMAC-SHA256-chained entry log — each entry covers the previous entry's hash (tamper-evident chain). Snapshot: COW fork of FS state; fssnap_create materialises a snapshot handle; reads from the snapshot see the frozen state. All three verified 721eaea.