Struct FileJournal 

pub struct FileJournal { /* private fields */ }

An append-only file of JSON lines, one entry per line, fsynced after every write.

Durability, exactly

• On open the file is validated. Every \n-terminated line must be an entry; a malformed terminated line is an error (a journal that cannot be read is not a journal, and a signer without one does not sign). An unterminated suffix is a torn write from a crash: if it parses as a whole entry only its newline was lost, and it is terminated; otherwise it is cut back to the last record boundary. The repair is synced, as is the directory after the file is created.
• record appends after that boundary and syncs. If the append fails part-way the file is cut back to the length it had immediately before this write, measured on the file itself, never to a length cached earlier (a cached length rolled back other writers’ acknowledged entries; found by the 2026-09-22 verification pass); if even that fails the journal refuses every later write, so a torn line can never have another record appended to it.
• One writer per file. open takes an exclusive advisory lock (flock) for the handle’s lifetime and a second live handle is refused by name (Error::Journal, “held by another handle”), so two rounds cannot share one file and roll each other back. The block round and the peg-out round each own their own journal.
• A torn record was never acknowledged, so nothing was signed on its strength: the intent is written before the custody signer is asked.

Implementations

impl FileJournal

pub fn open(path: impl AsRef<Path>) -> Result<Self>

Open or create path, creating its directory, validating the file and repairing a torn tail (see the type’s documentation).

pub fn path(&self) -> &Path

Where it lives.

Trait Implementations

impl Debug for FileJournal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl VoteJournal for FileJournal

fn record(&mut self, entry: &VoteEntry) -> Result<()>

Write an entry durably. Returning an error means the signer does not sign (for an intent) or does not publish (for a signature).

fn entries(&self) -> Result<Vec<VoteEntry>>

Every entry, oldest first.