fat/usb-storage: flush the device cache on close so writes survive power-off

init writes /mnt/usb/DANOS.LOG at shutdown and then enters S5 — but the write sat in the USB flash controller's write cache and was lost when power was cut, because nothing issued SCSI SYNCHRONIZE CACHE. Invisible in QEMU (its backing file commits immediately); real on hardware. The boot-time flush survived only because the machine kept running afterward and the cache drained on its own.

- block protocol gains a flush op; usb-storage serves it with SYNCHRONIZE CACHE (10); runtime.block gains Device.flush()
- the FAT server tracks whether blocks were written and, on a file close, commits the device cache (durable-on-close — the right default for removable media, and it makes init's existing shutdown close() persist the log before S5, no init/VFS change needed)
- verified the SYNCHRONIZE CACHE actually reaches the driver on each dirty close; usb-storage/fat-mount/mutations/rename/mtime/log-flush all green

library/runtime/block.zig

@@ -38,6 +38,13 @@ pub const Device = struct {
         return self.transfer(.write, lba, count, physical);
     }
 
+    /// Commit any device write cache to stable media (SCSI SYNCHRONIZE CACHE), so
+    /// prior writes survive a power-off. A filesystem calls this before the machine
+    /// goes down; no data transfer, so the buffer arguments are unused.
+    pub fn flush(self: Device) bool {
+        return self.transfer(.flush, 0, 0, 0);
+    }
+
     fn transfer(self: Device, operation: protocol.Operation, lba: u64, count: u32, physical: u64) bool {
         var request = protocol.Request{ .operation = @intFromEnum(operation), .lba = lba, .count = count, .physical = physical };
         var reply: [protocol.reply_size]u8 = undefined;

system/drivers/usb-storage/scsi.zig

@@ -15,6 +15,7 @@ const op_inquiry: u8 = 0x12;
 const op_read_capacity_10: u8 = 0x25;
 const op_read_10: u8 = 0x28;
 const op_write_10: u8 = 0x2A;
+const op_synchronize_cache_10: u8 = 0x35;
 
 /// INQUIRY: standard device data (36 bytes: peripheral type, removable, vendor
 /// and product strings).
@@ -57,6 +58,16 @@ pub fn write10(lba: u32, blocks: u16) [10]u8 {
     return cdb;
 }
 
+/// SYNCHRONIZE CACHE(10): commit the device's write cache to stable media. LBA 0
+/// and block count 0 mean "the whole medium". No data stage. Without this a write
+/// can sit in the USB flash controller's cache and be lost if power is cut right
+/// after — which is exactly what a shutdown-time log flush hits on real hardware.
+pub fn synchronizeCache10() [10]u8 {
+    var cdb = [_]u8{0} ** 10;
+    cdb[0] = op_synchronize_cache_10;
+    return cdb;
+}
+
 /// Decode an 8-byte READ CAPACITY(10) reply.
 pub fn parseCapacity(bytes: [8]u8) struct { last_lba: u32, block_size: u32 } {
     return .{

system/drivers/usb-storage/usb-storage.zig

@@ -147,6 +147,14 @@ fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?runtime
             const ok = transact(&cdb, false, request.physical, request.count * block_size);
             return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = block_size, .block_count = if (ok) request.count else 0 });
         },
+        @intFromEnum(block_protocol.Operation.flush) => {
+            // SYNCHRONIZE CACHE: commit the device's write cache to flash. No data
+            // stage. Makes prior writes durable before a caller (init at shutdown)
+            // cuts power. A device without a volatile cache reports success anyway.
+            const cdb = scsi.synchronizeCache10();
+            const ok = transact(&cdb, false, 0, 0);
+            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = block_size, .block_count = 0 });
+        },
         else => return 0,
     }
 }

system/services/block/protocol.zig

@@ -16,6 +16,10 @@ pub const Operation = enum(u32) {
     read = 1,
     /// write(lba, count, physical): write `count` blocks at `lba` from the buffer
     write = 2,
+    /// flush(): commit any device write cache to stable media (no data transfer).
+    /// A filesystem calls this to make prior writes durable — e.g. before power-off,
+    /// so a shutdown-time write isn't lost in the USB flash controller's cache.
+    flush = 3,
 };
 
 pub const Request = extern struct {

system/services/fat/fat.zig

@@ -40,11 +40,16 @@ const IpcBlock = struct {
         const self: *IpcBlock = @ptrCast(@alignCast(context));
         const destination: [*]u8 = @ptrFromInt(self.bounce.virtual);
         @memcpy(destination[0..512], buffer[0..512]);
-        return self.device.write(lba, 1, self.bounce.physical);
+        if (!self.device.write(lba, 1, self.bounce.physical)) return false;
+        device_dirty = true; // a block reached the device; a close will flush it
+        return true;
     }
 };
 
 var ipc_block: IpcBlock = undefined;
+// Set whenever a block is written, cleared when the device cache is flushed on a
+// file close — so writes are committed to stable media before a power-off.
+var device_dirty: bool = false;
 var filesystem: engine.FileSystem = undefined;
 
 // Open handles the VFS holds against this backend: each maps a node id to a
@@ -192,6 +197,14 @@ fn onMessage(message: []const u8, out: []u8, sender: u32, capability: ?runtime.i
         },
         .close => {
             if (openAt(request.node)) |o| o.used = false;
+            // Durable-on-close: if any block reached the device since the last
+            // flush, commit its cache to stable media now (best-effort). This is
+            // what makes init's shutdown log flush survive a real power-off, and is
+            // the right default for removable media the user may unplug.
+            if (device_dirty) {
+                _ = ipc_block.device.flush();
+                device_dirty = false;
+            }
             return writeReply(out, .{ .status = 0 }, &.{});
         },
         .mkdir => {