Technical Report — Version 2 BEAMFS v2 is a Linux filesystem providing autonomic recovery from electromagnetic perturbations of persistent storage, including stochastic single-event upsets, multi-bit upsets, and adversarial high-power electromagnetic events. BEAMFS v2 follows the FTRFS lineage of Fuchs et al. (2015) and extends it with two contributions: (i) An INLINE protection scheme applying Reed-Solomon RS (255, 239) per 255-byte subblock with sixteen subblocks per 4 KiB disk block, recovering up to 8 symbol errors per subblock and up to 128 symbol errors per block, on the read path, in place, and persisted to disk byte-perfect (autonomic in-place repair). (ii) An explicit saturation observability contract: when a perturbation exceeds the per-subblock correction capacity, the recovery operator returns fail-closed and emits a journal entry flagged uncorrectable, making the saturation event observable post-mortem rather than silent. Threat model and theorem revision The threat model is restated in electromagnetic terms (EMR threat model) covering both stochastic perturbations (Family A, modelled by canonical SEU/MBU rate calculations under JEDEC JESD89A and IEEE/IEC standards) and adversarial perturbations (Family B, IEMI/HPM/EMP regimes per IEC 61000-2-13 and 61000-4-36), bounded by a transverse saturation boundary at the per-subblock correction capacity. The recovery soundness theorem of the v1 report (Theorem IV. 1) was empirically falsified by the companion fault injection operator RadFI on 2026-04-28. The present report retracts that theorem, reformulates the recovery calculus, and presents two replacement statements: Theorem v2. 1 (recovery under bounded EMR perturbation), which retains the termination/safety/coverage structure of Theorem IV. 1 with an EMR-stated hypothesis on the perturbation family; and Theorem v2. 2 (saturation observability), which formalizes the contract that fail-closed recovery emits an auditable uncorrectable-flagged journal entry at the affected (block, subblock) coordinates. Empirical results Byte-level disk corruption of an INLINE-formatted volume is recovered byte-perfect (Stage 3, recovery validation milestone). Read latency on the INODEUNIVERSAL protection scheme matches ext4 on median and 95th percentile, with a 1. 85x p99 tail (Stage 4, B1). Write+fsync latency carries an ~8x median overhead versus ext4 due to per-block RS encoding, with a tighter overall distribution (1. 74x p50/p99 spread for BEAMFS versus 5. 00x for ext4, Stage 4, B2). INLINE read on the conformance fixture canary block, ten runs of ~38, 000 reads each, exhibits zero RS correction events and a stable fixture SHA-256 (Stage 4, B3). The kernel module totals 2, 198 lines of C, well under the 5, 000-line audit budget targeted for safety-critical certification regimes (DO-178C, ECSS-E-ST-40C, IEC 61508). Companion methodology paper The empirical falsification of v1 Theorem IV. 1 was produced by the algebraic fault injection operator RadFI v1, published as a companion methodology paper at DOI 10. 5281/zenodo. 19885777. The two papers are designed to be read together: BEAMFS v2 defines the recovery calculus, RadFI defines the falsification instrument; both quantify over the same filesystem state space. Implementation and reproducibility The reference implementation is publicly available at github. com/roastercode/beamfs, GPG-signed under tag v1. 0. 0-paper-zenodo-pending (commit 52260d0), with all empirical results reproducible from the tagged commit. Conformance fixture SHA-256 hashes are normative and reproducible across x86₆4 and aarch64 builds. Position with respect to neighbouring work BEAMFS v2 sits at the intersection of three traditions: the FTRFS lineage of radiation-robust filesystems for space applications, the formal filesystem-verification tradition (FSCQ, seL4, Yggdrasil), and the radiation hardness assurance tradition (NASA-HDBK-4002A, ESA ECSS-Q-ST-60-15C, MIL-STD-882E). The present report extends the first with per-subblock granularity, adopts the discipline of explicit hypotheses from the second, and follows the conventions of the third for symbol-counted correction capacity reporting. License: CC-BY-4. 0 (paper text). GPL-2. 0 for referenced source code.
Aurelien Desbrieres (Wed,) studied this question.