Function diag_open_private_stats_file

src/foundation/diagnostics.c:151–186

Create the stats file at its fixed, discoverable path without ever writing * through something another process planted there. Exclusive creation IS the * guarantee, so the predictable name stays safe: the unlink drops a stale file * from an earlier run with this pid (and, if a local attacker pre-created a * symlink, removes the link itself — never its target), and the O_EXCL create * that fol

 * O_NOFOLLOW is belt-and-braces for the same window on POSIX. Mode 0600: the
 * snapshot describes this process's heap layout, so it is owner-only. */
static FILE *diag_open_private_stats_file(const char *path) {
    (void)cbm_unlink(path);
#ifdef _WIN32
    /* _wopen mirrors cbm_mkstemp's Windows contract — the ANSI CRT interprets
     * the UTF-8 bytes of a non-ASCII %TEMP% in the local codepage and fails. */
    wchar_t *wide = cbm_path_to_wide(path);
    if (!wide) {
        return NULL;
    }
    int descriptor = _wopen(wide, _O_WRONLY | _O_CREAT | _O_EXCL | _O_BINARY | _O_NOINHERIT,
                            _S_IREAD | _S_IWRITE);
    free(wide);
    if (descriptor < 0) {
        return NULL;
    }
    FILE *sink = _fdopen(descriptor, "wb");
    if (!sink) {
        (void)_close(descriptor);
    }
    return sink;
#else
    int flags = O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC;
#ifdef O_NOFOLLOW
    flags |= O_NOFOLLOW;
#endif
    int descriptor = open(path, flags, 0600);
    if (descriptor < 0) {
        return NULL;
    }
    FILE *sink = fdopen(descriptor, "wb");
    if (!sink) {
        (void)close(descriptor);
    }
    return sink;
#endif
}

static void diag_write_allocator_stats(void) {
    char flag[CBM_SZ_16];