Enum DurabilityPolicy 

#[non_exhaustive]
pub enum DurabilityPolicy {
    Maximal,
    Segment,
    Throughput,
}

Per-flush durability tradeoff between throughput and crash safety.

Selects how many fsyncs the write path performs when flush spills a batch to disk. Higher durability costs throughput; lower durability relies on the cloud (or wherever the durable copy lives) to absorb crash loss. Since v0.6.0, Throughput is the default: the crate’s target use case is the local throughput buffer in front of cloud sync, where the cloud endpoint is the durable layer.

Crash-loss semantics

Policy	Fsync file data	Fsync dir after rename	Worst-case crash loss
Maximal	yes	yes	last in-flight flush only
Segment	yes	no	rename window (~5–30s of flushes on ext4/xfs)
Throughput	no	no	entire OS dirty window (~30s) — cloud is durable

Maximal is for standalone-queue deployments where this buffer is the last copy. Throughput (the default since v0.6.0) is the correct choice for cloud-sync deployments where the cloud endpoint holds the durable copy and the local disk is a throughput buffer. Segment is the pre-v0.6.0 default.

The rename-window gap (why Segment is not “fully durable”)

Segment (the pre-v0.6.0 default) calls file.sync_all() on the segment data before fs::rename, but it does not dir.sync_all() after the rename. On ext4/xfs defaults, a host crash within the kernel’s dir-inode flush window (~5–30s) can leave the renamed file’s data on disk but unreachable through the directory. SQLite went through this exact lesson. So Segment was already not fully durable; the enum just makes the tradeoff explicit. Maximal closes the rename-window gap.

Implementation

The policy is branched on inside SegmentStore::write_atomic (not a callback): it is a Copy enum with no allocation, and the Mutex<Compressor> invariant (“never held across I/O”) is preserved because the fsync happens after compression is done and the mutex is released.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Maximal

Fsync the segment file’s data and the parent directory inode after rename. Closes the rename-window gap. Use when this buffer is the last copy of the data (standalone-queue deployments).

Segment

Fsync the segment file’s data, but not the directory inode after rename. This is the pre-v0.6.0 default. A host crash within the kernel’s directory-inode flush window (~5–30s on ext4/xfs defaults) can leave the renamed file’s data on disk but unreachable through the directory. Select explicitly for standalone-queue deployments that prefer the pre-v0.6.0 behavior over Maximal.

Throughput

Skip fsync entirely. The kernel’s dirty-page flusher handles when the bytes reach disk (~30s on default Linux). The rename is still atomic, so concurrent readers never see a partial write — only a host crash within the dirty window can lose the segment. This is the Default since v0.6.0: the cloud is the durable layer and this buffer is the throughput buffer in front of it.

Trait Implementations

impl Clone for DurabilityPolicy

fn clone(&self) -> DurabilityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DurabilityPolicy

impl Debug for DurabilityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DurabilityPolicy

fn default() -> DurabilityPolicy

Returns the “default value” for a type.

impl Display for DurabilityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Human-readable representation suitable for logging and diagnostics.

The format is a single lowercase word per variant, stable across releases so operators can grep for it in log output.

impl Eq for DurabilityPolicy

impl PartialEq for DurabilityPolicy

fn eq(&self, other: &DurabilityPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DurabilityPolicy