1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
//! Directory-entry fencing (FENCE-CHAIN r8 R1a): the one fsync primitive every
//! owned directory entry passes through, plus the `cfg(test)` pending-mutation
//! journal the crash battery drives.
//!
//! Production surface is a single function, [`sync_dir_entry`]. Everything else in
//! this module — the journal, the FAILPOINT/LOSSY/OBSERVER hooks, the CUT — is
//! `cfg(test)` machinery and compiles out of release builds entirely. The whole
//! module is native-only (it is never part of the wasm rung's compilation), so the
//! instrumentation is inert on wasm by construction and that rung stays
//! byte-unchanged.
// The self-re-exec OS-kill crash harness (PinCase/run_pin). `pub(crate)` so
// the vacuum sweep's crash matrix (`db::vacuum::sweep_crash_tests`) drives the
// SAME protocol rather than standing up a second OS-kill coordinator — the
// ruling-3 lineage constraint honoured at the code level where the journal
// visibility boundary (crash_harness.rs header) does not force duplication.
pub use sync_dir_entry;
/// The D0 external-anchor remedy (FENCE-CHAIN r8 D0/D1, R4e).
///
/// Every fence chain terminates somewhere: the engine fences every directory
/// entry it OWNS, but the durability of the directory ABOVE each owned root is an
/// explicit operator precondition. A subsystem asked to create a root whose parent
/// does not exist refuses with `NotFound` PRESERVED and this exact remedy text
/// appended, rather than deep-`create_dir_all`-ing an ancestry it cannot vouch is
/// durably linked.
pub const D0_ANCHOR_REMEDY: &str = "create the parent directory and ensure it is durably linked (fsync it, or use \
an existing long-lived location)";