# K1636–K1640 bounded truncation and reader ownership

The in-memory three-block file starts with 1025 bytes in blocks 10, 20 and 30.
Its immutable reader guards pin the file's backing. Truncation rejects an active
reader with `Busy`, preserving length, bytes and allocation bits. Multiple readers
must all close before truncation can succeed. Guards cannot be copied; dropping
each guard releases one pin. A leaked guard conservatively keeps truncation busy.

After all readers close, shrinking to 100 bytes retains block 10 and releases only
blocks 20 and 30. Offset 99 remains readable, and offsets 100 and beyond return
EOF. Removed bytes in the in-memory backing are zeroed. Zero length retires all
file blocks. Metadata reservations remain allocated. Growing through truncate
is refused. Ownership checks and staged bitmap releases finish before publication,
so invalid ownership cannot partially change the file or allocation bits.

Two host tests, an omitted-reader-guard mutant, AArch64 no_std compilation and
six direct/UEFI guest profiles measure this bounded behavior. This is a serialized,
synthetic in-memory file model: it does not authenticate global block ownership,
perform durable inode/bitmap writes, integrate VFS readers, or prove SMP and
power-loss safety. Canonical product and production-write acceptance stay open.