fs: timestamps come from the clock, and /proc/fsstat says how full the tables are

Everything created after boot was stamped 1970. know() in SchFS and now_sec() in
the v1 filesystem both returned uptime(), under comments saying the kernel had no
wall clock -- which stopped being true when time_init() started reading the RTC.
The comments outlived the condition they described.

Two errors, and the second is the less obvious: uptime() counts 10 ms *ticks* and
they were being used as *seconds*, so a node created 0.6 s into boot read back as
00:01:00 and the clocks ran a hundred times too fast. Both now go through
wallclock(), which exists precisely so nothing can disagree with gettimeofday
about the time. Confirmed against the RTC line from the same boot.

The occupancy counters are the instrumentation docs/plan/roadmap.md asked for
while hunting the ls -lR hang: inode, file and pinned-buffer counts with a
high-water mark each, maintained at the 0->1 and 1->0 transitions rather than by
scanning, so they cost one increment on a path that already holds the table's
lock.

The peaks are the diagnostic. A live count only describes the moment you looked,
and a reference leak is invisible in it right up until the table is full -- at
which point iget() panics and filealloc() returns 0, which is where the trail
used to go cold.

What they measured: across ten iterations of ls -lR with writes interleaved, 33
execs and 13378 tree descents, inode_peak stayed at 9/200, file_peak at 9/512 and
buf_pinned_peak at 1/256, with the SchFS bracket unlocked throughout. That
eliminates the roadmap's own hypothesis -- "a lock or reference-count leak
somewhere in the *at() paths" -- and the hang did not reproduce. It is very
likely fixed in passing by the *at() dirfd rewrite, the getdents cookie rewrite
or SchFS becoming the root, all of which landed after it was reported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/dev/bio.c

@@ -116,7 +116,8 @@ bget(uint dev, uint64 blockno)
   // Is the block already cached?
   for(b = bcache.head.next; b != &bcache.head; b = b->next){
     if(b->dev == dev && b->blockno == blockno){
-      b->refcnt++;
+      if(b->refcnt++ == 0)
+        FSSTAT_TAKE(fsstat.buf_pinned, fsstat.buf_pinned_peak);
       release(&bcache.lock);
       acquiresleep(&b->lock);
       return b;
@@ -132,6 +133,7 @@ bget(uint dev, uint64 blockno)
       b->blockno = blockno;
       b->flags = 0;
       b->refcnt = 1;
+      FSSTAT_TAKE(fsstat.buf_pinned, fsstat.buf_pinned_peak);
       release(&bcache.lock);
       acquiresleep(&b->lock);
       return b;
@@ -154,6 +156,7 @@ bget(uint dev, uint64 blockno)
     if(b->refcnt == 0){
       fsstat.bget_evict_dirty++;
       b->refcnt++;              // claim it, so nobody else recycles it either
+      FSSTAT_TAKE(fsstat.buf_pinned, fsstat.buf_pinned_peak);
       release(&bcache.lock);
       acquiresleep(&b->lock);
 
@@ -167,6 +170,7 @@ bget(uint dev, uint64 blockno)
       acquire(&bcache.lock);
       if(b->refcnt != 1){
         b->refcnt--;
+        FSSTAT_DROP(fsstat.buf_pinned);
         release(&bcache.lock);
         releasesleep(&b->lock);
         goto retry;
@@ -273,6 +277,7 @@ brelse(struct buf *b)
   acquire(&bcache.lock);
   b->refcnt--;
   if (b->refcnt == 0) {
+    FSSTAT_DROP(fsstat.buf_pinned);
     // no one is waiting for it.
     b->next->prev = b->prev;
     b->prev->next = b->next;

kernel/dev/procfs.c

@@ -33,6 +33,7 @@
 #include "uaccess.h"
 #include "errno.h"
 #include "fsstat.h"
+#include "schfs.h"
 
 #define PROC_BUFSZ 2048
 
@@ -199,7 +200,7 @@ gen_cpuinfo(struct sbuf *sb)
   if (ncpu_online < ncpu) {
     sb_kv(sb, "cpus present\t: ", ncpu, 0);
     sb_puts(sb, "note\t\t: additional processors are enumerated but not "
-                "started; see docs/roadmap.md\n");
+                "started; see docs/plan/roadmap.md\n");
   }
 }
 
@@ -338,6 +339,33 @@ gen_fsstat(struct sbuf *sb)
   sb_puts(sb, "\ndescents         "); sb_putu(sb, fsstat.descents);
   sb_puts(sb, "\nexec_calls       "); sb_putu(sb, fsstat.exec_calls);
   sb_puts(sb, "\nexec_kcycles     "); sb_putu(sb, fsstat.exec_cycles / 1000);
+
+  // Occupancy. The peaks are the diagnostic: a peak that climbs across a
+  // session and never falls back after the commands finish is a reference
+  // leak, and which line it is on says where to look.
+  sb_puts(sb, "\ninode_used       "); sb_putu(sb, fsstat.inode_used);
+  sb_puts(sb, "\ninode_peak       "); sb_putu(sb, fsstat.inode_peak);
+  sb_puts(sb, " / "); sb_putu(sb, NINODE);
+  sb_puts(sb, "\nfile_used        "); sb_putu(sb, fsstat.file_used);
+  sb_puts(sb, "\nfile_peak        "); sb_putu(sb, fsstat.file_peak);
+  sb_puts(sb, " / "); sb_putu(sb, NFILE);
+  sb_puts(sb, "\nbuf_pinned       "); sb_putu(sb, fsstat.buf_pinned);
+  sb_puts(sb, "\nbuf_pinned_peak  "); sb_putu(sb, fsstat.buf_pinned_peak);
+  sb_puts(sb, " / "); sb_putu(sb, NBUF);
+
+  // The SchFS bracket. `locked 1` with `owner 0` is the wedge: the volume lock
+  // is held by something that is not in a transaction, so nothing will ever
+  // release it and every later filesystem call sleeps in acquiresleep.
+  for (int i = 0; i < SCHFS_VOL_SLOTS; i++) {
+    int locked, owner, depth;
+    schfs_lockinfo(i, &locked, &owner, &depth);
+    if (locked < 0)
+      continue;
+    sb_puts(sb, "\nschfs"); sb_putu(sb, (uint64)i);
+    sb_puts(sb, "  locked "); sb_putu(sb, (uint64)locked);
+    sb_puts(sb, "  tx_owner_pid "); sb_putu(sb, (uint64)owner);
+    sb_puts(sb, "  tx_depth "); sb_putu(sb, (uint64)depth);
+  }
   sb_puts(sb, "\n");
 }