Module fs_atomic 

Structs

CloneDurabilityBatch

Path-scoped durability suppression for reconstructible clone writes.

StagedAtomicWrite

Functions

clone_write_is_deferred

create_dir_all_durable

Create a directory and any missing ancestors, making new dirents crash-durable.

create_private_dir_all

Create a directory tree with owner-only permissions on Unix (0o700), making newly created dirents crash-durable (same fsync chain as create_dir_all_durable).

enrich_fs_error

Wrap an io::Error produced by a filesystem operation against path with a heddle-context message naming both the operation and the path.

enrich_rename_error

Wrap an EXDEV error from fs::rename with both the source temp path and the destination — the user needs both to understand which mount boundary the rename tripped on. Other error kinds delegate to enrich_fs_error using the destination as the principal path.

is_cross_device_link

Returns true when an io::Error indicates a rename (or other link-style operation) attempted to bridge two filesystems (EXDEV). This is what trips when temp_path lands on a different mount than the destination — typically because TMPDIR is on a different volume, or the parent directory itself is a bind mount. We match both the portable ErrorKind::CrossesDevices and the raw EXDEV code.

is_directory_not_empty

Returns true when an io::Error indicates a directory could not be removed because it still contained entries. The apply planner only removes tracked descendants; when tracked content is removed and the parent directory still holds untracked or explicitly ignored siblings, remove_dir returns this signal. We need both ErrorKind::DirectoryNotEmpty and the raw codes — Linux=39, macOS/BSD=66, Windows=145 — because Rust does not always translate every kernel surface into the portable ErrorKind.

is_not_found

Returns true when an io::Error indicates the path referenced by an operation does not exist (ENOENT on Unix, ERROR_FILE_NOT_FOUND / ERROR_PATH_NOT_FOUND on Windows). Use this only at call sites where the operation expected the path to exist — the predicate alone can’t distinguish “I expected this” from “I checked optionally”.

is_out_of_space

Returns true when an io::Error indicates the filesystem is out of space. Centralised here because it’s the same predicate used by write_file_atomic (the inner helper) and by the higher-level cmd_snapshot recovery path that prints the actionable message.

is_permission_denied

Returns true when an io::Error indicates the operation was denied for permissions reasons (EACCES on Unix, ERROR_ACCESS_DENIED on Windows). The portable ErrorKind::PermissionDenied covers most surfaces; the raw EACCES check handles oddball platforms that surface the OS code without translating to the portable kind.

is_read_only_filesystem

Returns true when an io::Error indicates the underlying filesystem is mounted read-only (EROFS on Unix). The portable ErrorKind::ReadOnlyFilesystem is preferred when present; we also match the raw OS code because some platforms (notably older macOS surfaces and certain remote filesystems) do not always translate.

publish_file_durable

record_deferred_clone_barrier

stage_file_atomic_secret

stage_temp_files_durable

Write many temp files with a single overlapped-writeback durability pass.

sync_directory

sync_file

Sync one file unless it belongs to an active clone durability batch.

sync_file_data

temp_path

write_file_atomic

write_file_atomic_reconstructible

Atomically publish reconstructible bytes without forcing them to stable storage. The final path is never observed partially written, but a crash may lose this write. Callers must have an independent durable source from which the file can be rebuilt.

write_file_atomic_secret

Atomically write secret material without ever creating a group/world readable temporary file.