- name: partial-writes-advance-by-count
  where: "write_all.c"
  ensure: >-
    After a successful write, offset must advance by the number of bytes actually written, not assume the full buffer was accepted.

- name: descriptor-closes-on-sync-error
  where: "flush_close.c"
  each: method
  ensure: >-
    flush_close must call close(fd) unconditionally after fsync and before returning. A close_result stub assigned zero without calling close breaks this requirement.