Function write_atomic_mirrored 

pub fn write_atomic_mirrored(
    root: &Path,
    slow: &SlowRoot,
    filename: &str,
    bytes: &[u8],
) -> Result<()>

write_atomic, and then the SAME bytes again into the metadata mirror (crate::slow’s dir.meta.path — a second copy on the other spindle).

Why the mirror cannot fail the save

The primary write has already landed and been fsync’d by the time the mirror is attempted. Returning the mirror’s error would report a save that DID happen as a failure, and the caller’s only sane response — retry — would rewrite a file that is already correct. Worse, on the appliance the caller is a control-plane verb an operator typed on a box with no shell: a full or read-only slow disk would take the roster away from them entirely.

So a mirror failure is one WARN naming the path, and the save is Ok. What stops that from becoming a silent lie is the other half of this design: SlowRoot::claim_of never reports the mirror as satisfied unless the layout config’s dir.meta.off_stripe_satisfied says so, and so nobody plans a recovery around a mirror that is not there.