pub fn remove_durable(root: &Path, filename: &str) -> Result<()>Expand description
Remove a per-box MARKER durably: unlink it, then fsync the directory, so
the removal survives a power cut and not only the next stat.
MEASURED under KVM 2026-09-21 (lane T3): twin::restore_finish unlinked
txlog-restoring with a bare remove_file, and the operator’s “restart the
box” came as a stop ten seconds later. The unlink was still in the guest’s
page cache; the restored box reopened WITH the marker, as a box mid-restore —
follower-only, every control-plane write refused (“this box is a twin (or
restoring); it originates no transactions”), its audit trail written to a
per-box path, no re-seal. A marker whose PRESENCE changes what a box is must
have its ABSENCE made as durable as its presence was (write_atomic_unframed
already fsyncs the directory after creating one). A missing file is Ok.