Thanks, Charles!
So, if we run out of available space, I'll get an error when I try to write to the hole? That should be OK... Very neat.
In the case I'm investigating, the header says 16k, but the file size is only 4k.
I used "rwd" mode which syncs data by not metadata writes. In other words, it uses fdatasync() instead of fsync(). I think the file size qualifies as metadata. It sounds like my header write synced to storage but the file size metadata didn't, even though it was written first.
If I turn on metadata syncing, ftruncate() should sync, and everything should be OK.
Sound plausible?
Thanks,
Bob