Enum DurabilityPolicy 

#[non_exhaustive]
pub enum DurabilityPolicy {
    Maximal,
    Segment,
    Throughput,
}

Per-flush durability tradeoff between throughput and crash safety.

Selects how many fsyncs the write path performs when flush spills a batch to disk. Higher durability costs throughput; lower durability relies on the cloud (or wherever the durable copy lives) to absorb crash loss. The cloud-sync vision for this crate makes Throughput the natural default once callers opt in, but Segment remains the default for one release after the enum lands to avoid silently changing crash semantics for existing users.

Crash-loss semantics

Policy	Fsync file data	Fsync dir after rename	Worst-case crash loss
Maximal	yes	yes	last in-flight flush only
Segment	yes	no	rename window (~5–30s of flushes on ext4/xfs)
Throughput	no	no	entire OS dirty window (~30s) — cloud is durable

Maximal is for standalone-queue deployments where this buffer is the last copy. Throughput is the correct choice for cloud-sync deployments where the cloud endpoint holds the durable copy and the local disk is a throughput buffer. Segment is the pre-v0.5.0 behavior, kept as the default for one release for backward compatibility.

The rename-window gap (why Segment is not “fully durable”)

Segment (today’s default) calls file.sync_all() on the segment data before fs::rename, but it does not dir.sync_all() after the rename. On ext4/xfs defaults, a host crash within the kernel’s dir-inode flush window (~5–30s) can leave the renamed file’s data on disk but unreachable through the directory. SQLite went through this exact lesson. So Segment was already not fully durable; the enum just makes the tradeoff explicit. Maximal closes the rename-window gap.

Implementation

The policy is branched on inside SegmentStore::write_atomic (not a callback): it is a Copy enum with no allocation, and the Mutex<Compressor> invariant (“never held across I/O”) is preserved because the fsync happens after compression is done and the mutex is released.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Maximal

Fsync the segment file’s data and the parent directory inode after rename. Closes the rename-window gap. Use when this buffer is the last copy of the data (standalone-queue deployments).

Segment

Fsync the segment file’s data, but not the directory inode after rename. This is the pre-v0.5.0 behavior. Kept as the Default for one release after the enum lands, then flips to Throughput with a deprecation note.

Throughput

Skip fsync entirely. The kernel’s dirty-page flusher handles when the bytes reach disk (~30s on default Linux). The rename is still atomic, so concurrent readers never see a partial write — only a host crash within the dirty window can lose the segment. Use when the cloud is the durable layer and this buffer is the throughput buffer in front of it.

Trait Implementations

impl Clone for DurabilityPolicy

fn clone(&self) -> DurabilityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DurabilityPolicy

impl Debug for DurabilityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DurabilityPolicy

fn default() -> DurabilityPolicy

Returns the “default value” for a type.

impl Eq for DurabilityPolicy

impl PartialEq for DurabilityPolicy

fn eq(&self, other: &DurabilityPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DurabilityPolicy