pub fn record_audit(entry: &LogRecord) -> Result<()>Expand description
Appends one record to the fail-closed audit sink (audit.jsonl), for a
leased-write lifecycle event or refusal
(ADR-0080 §11).
Unlike record, this is not best-effort: it is not gated on
disabled (OMNI_DEV_LOG_DISABLE has no effect here — exemption from
that switch is the point of a forensic log), takes no part in rotation or
prune, and returns every error to the caller instead of swallowing
it. A caller whose write-ahead intent record fails to land here must not
perform the mutation it was about to audit — that is what “fail-closed”
means for this sink; see record’s own doc comment for the contrasting,
deliberately best-effort contract every other record in this module
keeps.
Refuses outright if entry.kind isn’t RecordKind::Audit. The reverse
misconfiguration — OMNI_DEV_LOG_FILE naming the audit file, which would
otherwise let best-effort records land in the fail-closed sink — no
longer needs a check here: log_file_path itself now refuses to
resolve a path that aliases audit_file_path
(#1747, ADR-0080
§11), so no request-log path this function could be handed ever collides
with path in the first place.
The appended line is fsynced (sync_data, then the parent directory
on unix so a freshly created file’s entry is durable too) before this
returns — the one place in the module that pays for it. “Durably
written before the mutating call” (ADR-0080 §11) has to survive more
than the process dying: a plain write only reaches the page cache,
which an OS crash or power loss between this return and the mutating
call would discard, leaving a mutation with no intent record — the
exact gap the sink exists to make impossible. Two syncs per leased
write are cheap; the best-effort request log deliberately pays neither.