pub fn retire_packs(journal: &Path, offsets: &[u64]) -> Result<()>Expand description
Retire these packs: one tombstone row each, durable before this returns.
Called by GitOps::gc before it drops a single index row, and that order
is the crash contract. The two possible interruptions are not symmetric:
- killed before the tombstones are durable — the rows are still in the index, so the next open sees packs that have rows, calls them absorbed, and nothing is lost or resurrected. The GC simply did not happen.
- killed after — the rows may or may not have gone, and either way the next open reads a tombstone and refuses to re-queue the pack. The dead objects cannot come back.
The reverse order has a window in which the rows are gone and the journal still claims an unabsorbed pack, which is exactly the resurrection this function exists to close.
A torn write leaves a partial final message, which read_journal discards
with the rest of a torn tail — the same tolerance a torn pack row gets, and
safe for the same reason: a tombstone that did not land is a gc that did not
happen.
All the rows go out in one write(2) on an O_APPEND fd, so a push
appending through SafeWriter’s own fd at the same instant cannot land
inside one of them.