SD Card Corruption During Write Interrupted by Shutdown

[aferr]

I have an instance where I shutdown while running a game, then attempted to reboot, and it was no longer possible to boot from the SD card. I then mounted the SD to run fsck -- this found some orphaned clusters and incorrect free space in FSInfo Block which imply an interrupted write. (It will boot just fine after the fsck fixes, but it's a hassle to not be able to use the device until such a fix if you're out and about)

The README states:

Hold 1-2 seconds for quick save and shutdown; game will autoresume on boot. (short triple vibrate)

This might be the culprit. Are you sure this is a safe default choice and can this be disabled? I'm skeptical this can really be made robust enough.

[dime-online]

I can reproduce this consistently on a Miyoo Mini Flip running SprigUI v1.3.1.

I started with the FAT32 card confirmed clean: Windows reported NOT Dirty, the volume health was Healthy/OK, and a read-only CHKDSK found no errors. I then performed four normal documented quick-save shutdowns with 1-second and 2-second power-button holds. Sprig's logs show each hold invoking /mnt/SDCARD/sprig/scripts/save_poweroff.sh; none was a hard power cut.

Immediately after reconnecting the card, Windows displayed the scan-and-fix warning, fsutil dirty query reported the volume dirty, and Windows classified it as Warning / Full Repair Needed. Read-only CHKDSK still found no structural errors. This reproduces the dirty FAT state through the normal software shutdown path rather than through an incorrect button hold.

I also saw a user-visible consequence during earlier occurrences: PyUI logged ConfigCopier replacing Saves/mini-flip-system.json with the factory copy, followed by the theme falling back to spruce. The current config writer truncates the destination and writes JSON directly, while ConfigCopier treats any nonzero destination as usable without validating it. That gives an interrupted write a direct path to either malformed settings or a factory reset:

• sprigUI/App/PyUI/main-ui/devices/miyoo/system_config.py

  Lines 24 to 29 in 63c7b33

  	def save_config(self):
  	with self._lock:
  	try:
  	with open(self.filepath, 'w') as f:
  	json.dump(self.config, f, indent=8)
  	except Exception as e:

• https://github.com/spruceUI/sprigUI/blob/63c7b338babcbd1eb0cf0d9a25de5ea29c0e5410/App/PyUI/main-ui/utils/config_copier.py

Both v1.3.1 and current development still end save_poweroff.sh with sync followed directly by poweroff; the script never transitions the FAT filesystem read-only or unmounts it:

https://github.com/spruceUI/sprigUI/blob/63c7b338babcbd1eb0cf0d9a25de5ea29c0e5410/sprig/scripts/save_poweroff.sh

spruceOS addressed this class of problem through explicit SD unmounting, a RAM-executed second stage, and later descriptor/dependent-mount cleanup. Its later atomic-write cleanup is also relevant to the settings failure mode.

A wholesale spruceOS stage-two port was not safe here: Sprig's bind mounts and runtime differ, and two adaptations froze before reaching the RAM-stage marker. A much smaller Sprig-specific tail has worked reliably while preserving the stock behavior through sync:

• Leave autoresume capture and the existing app/emulator shutdown sequence unchanged.
• Close inherited standard descriptors and use a system-only PATH.
• Attempt exactly mount -o remount,ro /dev/mmcblk0p1 /mnt/SDCARD.
• Verify that exact vfat mount is read-only.
• Invoke /sbin/poweroff regardless, falling back to the stock poweroff path if the remount or verification fails.

I physically tested this from the menu and twice in-game. Poweroff completed normally, autoresume still worked, RetroArch logged successful auto-state/SRAM save and load, and the save/state files remained intact. On every reconnection Windows reported NOT Dirty and Healthy/OK, and read-only CHKDSK found no problems.

This looks fixable with a small Sprig-specific clean-state transition before poweroff, without changing its quick-save/autoresume behavior or importing unrelated spruceOS device code. I can provide the minimal diff and test cases if useful.