Binds the store to one path on one filesystem.
Injected filesystem access.
Absolute path of the store.
How to read a file an older release wrote as a list.
Reads the store, classifying absence and damage rather than throwing.
A snapshot, or a failure when the path cannot be assessed.
Replaces the store's contents, optionally moving a damaged file aside.
Ordering is the whole point: the replacement is staged, flushed and verified before anything at the canonical path is disturbed, so a crash leaves either the old file or the new one there, never nothing. The staged bytes are fsynced before the rename; the directory entry is not, so a power loss can still show the predecessor — the weaker of those two outcomes, not a third one.
One exception, and it is narrow. Quarantining a damaged predecessor takes two renames that cannot be made one, so a crash between them leaves the canonical path empty with the old bytes under the quarantine name. A failure between them is recovered by putting the predecessor back; a `SIGKILL` cannot be, and the next read reports a cold start while the damaged evidence survives for an operator to find.
Records to persist and whether to quarantine first.
What the commit did, or why it did nothing.
Writes records to a path that must still be free, whole or not at all.
For a file two processes race to create, where the first must win and the second must learn that it lost. commit replaces whatever is at the path; this refuses a taken name and leaves it as it was. The records are staged and verified exactly as for a commit, then published only if the name is free, so no reader ever sees them half-written.
Records to persist at the free name.
What the commit did, or why it did nothing; EEXIST means the
name was taken.
Deletes staged files an earlier run was killed before cleaning up.
Only files older than STALE_STAGING_AGE_MS are touched. A staged file is otherwise indistinguishable from one a concurrent commit is seconds away from renaming, and deleting that would turn this from a tidy-up into data loss.
Public because a successful commit is not a sufficient trigger on its own: a process that crashes and never commits again would keep its leftover for ever, and one that commits within the grace period is too early to collect it. Whoever owns the process lifecycle should also call this after startup, once the grace period has passed.
How many were removed, or why the directory could not be read.
Reads and writes a JSON record store without trusting what it finds.