Module atomic_fs 

Facade: atomic-write mechanics live in the lean-ctx-fs crate.

Enums

StoreReadError

Why a store file could not be read safely.

Functions

in_place_overwrite

In-place overwrite of an existing file inode (O_WRONLY|O_TRUNC, plus O_NOFOLLOW on Unix). Works when the parent directory is read-only but the file itself is writable. Not crash-atomic — used only as a fallback when the atomic path is impossible.

is_orphaned_temp

Whether name is a temp file of these atomic writes that a crash left behind: its writer is gone, or it is older than an hour (#958).

is_readonly_dir_error

True for errors that mean “this directory won’t accept create/rename” even though the target file may be writable: EROFS (read-only fs) plus EACCES/EPERM (directory write denied).

read_store_file

Read a file of a local content store (archive, tee) for the model without following links out of the store and without a check-then-open race.

replace_file

Atomically move a fully written tmp over path: rename(2) on Unix, windows_replace (with its bounded retry of a held target) on Windows. tmp is left in place on failure; the caller removes it.

sync_directory

Make a preceding rename/create/remove in dir durable, reporting failure. On Unix this fsyncs the directory. Windows cannot flush a directory through a plain File::open (it fails with ERROR_ACCESS_DENIED); NTFS journals directory metadata itself, so only the directory’s existence is verified there — the same contract as the #[cfg(unix)] sync sites elsewhere in the crate.

try_atomic_write

Durable, crash-atomic write: a temp file in the same directory as path followed by rename over the target. Requires write permission on the parent directory; the read-only-directory fallback is handled by write_bytes_with_fallback.

try_atomic_write_if

try_atomic_write with a last word for the caller: may_commit is asked once the new content is fully staged and synced, immediately before the replace. On false the staged file is removed, path is untouched and the error kind is TimedOut. Everything slow (cleanup, create, write, sync) lies before that question; after it only the replace itself follows — which on Windows may retry a held target for about a second.

try_atomic_write_unswept

try_atomic_write without the sweep for orphaned temps: for a directory of very many files (the gateway evidence store) where listing it on every write would cost more than the write, and whose owner removes stale temps itself (is_orphaned_temp).

write_bytes_with_fallback

Atomic write with the read-only-directory in-place fallback (#459). Tries the crash-atomic temp+rename first; if that fails because the directory is read-only/permission-denied but an existing file inode is writable, overwrite it in place. permissions, when given, is applied to the written file.