test(syncfs): lock in FS family + fd kind classification

Audit of syncfs(2) confirmed the existing tracing is correct: single fd
arg (fd=args[0], KindFd), FamilyFS like its fsync/fdatasync/
sync_file_range siblings, and an int 0/-1 return that stays Unclassified
(plain ret_event). No code or generated artifacts changed.

Add lock-in tests so a stray reclassification trips CI:
- TestClassifySyncFamilyFdSyscallsByName: enter -> KindFd for the
  fsync/fdatasync/syncfs/sync_file_range group.
- TestClassifyExitSyncfs: exit -> KindRet.
- sync-family FamilyFS assertions in TestClassifySyncallFamily.
- syncfs added to the ret-UNCLASSIFIED list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 71 insertions, 0 deletions

diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index 768e367..fecbb93 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -315,6 +315,59 @@ func TestClassifySocketFdSyscallsByName(t *testing.T) {
 	}
 }
 
+// TestClassifySyncFamilyFdSyscallsByName locks in that the filesystem-sync
+// family (fsync/fdatasync/syncfs/sync_file_range) is classified as KindFd on
+// enter. Each of these takes an open file descriptor as args[0]:
+//   - int fsync(int fd)
+//   - int fdatasync(int fd)
+//   - int syncfs(int fd)
+//   - int sync_file_range(int fd, off64_t offset, off64_t nbytes, unsigned flags)
+//
+// so their enter tracepoint carries a leading fd field and must capture
+// fd=args[0] into a fd_event (KindFd), matching the generated
+// handle_sys_enter_* handlers. (Plain sync() takes no args and is KindNull;
+// it is asserted separately in the classification table test.)
+func TestClassifySyncFamilyFdSyscallsByName(t *testing.T) {
+	tests := []string{
+		"fsync",
+		"fdatasync",
+		"syncfs",
+		"sync_file_range",
+	}
+	for _, name := range tests {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: "sys_enter_" + name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "int", Name: "fd"},
+				},
+			})
+			if r.Kind != KindFd {
+				t.Errorf("%s: got kind %d, want KindFd", name, r.Kind)
+			}
+		})
+	}
+}
+
+// TestClassifyExitSyncfs locks in that the syncfs exit tracepoint is classified
+// as KindRet. syncfs(2) returns int (0 on success, -1 on error) and transfers
+// no bytes, so its exit format carries a single "ret" field and must map to a
+// plain ret_event (KindRet, Unclassified) — matching the generated
+// sys_exit_syncfs handler and its fsync/fdatasync siblings.
+func TestClassifyExitSyncfs(t *testing.T) {
+	r := ClassifyFormat(&Format{
+		Name: "sys_exit_syncfs",
+		ExternalFields: []Field{
+			{Type: "long", Name: "__syscall_nr"},
+			{Type: "long", Name: "ret"},
+		},
+	})
+	if r.Kind != KindRet {
+		t.Errorf("exit_syncfs: got kind %d, want KindRet", r.Kind)
+	}
+}
+
 // TestClassifyExitGetpeername locks in that the getpeername exit tracepoint is
 // classified as KindRet. getpeername(2) returns int (0 on success, -1 on
 // error), so its exit format carries a single "ret" field and must map to a
diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go
index 0e284a3..c553d26 100644
--- a/internal/generate/family_test.go
+++ b/internal/generate/family_test.go
@@ -56,6 +56,20 @@ func TestClassifySyscallFamily(t *testing.T) {
 		{"sys_exit_utimes", FamilyFS},
 		{"sys_enter_utimensat", FamilyFS},
 		{"sys_enter_futimesat", FamilyFS},
+		// The filesystem-sync family commits cached file data/metadata to disk
+		// and all classify as FamilyFS: sync(2) (no args, whole system),
+		// syncfs(2) (one fd, the filesystem containing that fd), and the
+		// per-file fsync(2)/fdatasync(2)/sync_file_range(2). syncfs and its
+		// siblings must stay together in FamilyFS — assert the whole group so a
+		// stray reclassification of any one trips this test. Keep in sync with
+		// the FS list in docs/syscall-tracing-plan.md.
+		{"sys_enter_sync", FamilyFS},
+		{"sys_exit_sync", FamilyFS},
+		{"sys_enter_syncfs", FamilyFS},
+		{"sys_exit_syncfs", FamilyFS},
+		{"sys_enter_fsync", FamilyFS},
+		{"sys_enter_fdatasync", FamilyFS},
+		{"sys_enter_sync_file_range", FamilyFS},
 		{"sys_enter_epoll_wait", FamilyPolling},
 		{"sys_enter_io_uring_enter", FamilyAIO},
 		{"sys_enter_bpf", FamilySecurity},
diff --git a/internal/generate/retclassify_test.go b/internal/generate/retclassify_test.go
index 70ade1a..148c1e6 100644
--- a/internal/generate/retclassify_test.go
+++ b/internal/generate/retclassify_test.go
@@ -44,6 +44,10 @@ func TestClassifyRetUnclassified(t *testing.T) {
 		"openat", "close", "rename", "unlink", "fcntl", "dup", "dup2", "dup3",
 		"mkdir", "rmdir", "chmod", "chown", "chdir", "stat", "lseek",
 		"truncate", "fallocate", "mmap", "fsync", "flock", "recvmmsg", "sendmmsg",
+		// syncfs(2) returns int 0/-1 (no byte count); it commits the filesystem
+		// containing args[0]'s fd and transfers no bytes, so its exit must stay
+		// UNCLASSIFIED (plain ret_event), like its fsync/fdatasync siblings.
+		"syncfs",
 		// gettimeofday(2) returns int 0/-1 (no byte count); its exit carries a
 		// plain ret_event and must stay UNCLASSIFIED, not a read/write transfer.
 		"gettimeofday",