Module storage_probe 

One-shot startup probe of the SQLite and file-system storage backends.

Consensus writes to disk on every view, taking the database’s (or data directory’s) single writer lock. A validator on a network filesystem, a volatile filesystem, or a disk with slow fsync sees that cost as consensus timeouts, with nothing pointing at the storage layer. This module answers that once per process start, and never fails startup: every part that can error degrades to an unknown/absent value and logs at DEBUG.

The fs backend never calls fsync itself (fs::Persistence writes via std::fs::write, which does not sync); the fsync number still bounds sync_data cost there, and the filesystem classification is backend-neutral either way.

Structs

FsInfo

FsyncStats

p50/max time the whole write loop (seek + write_all + sync_data), so they measure durable-write latency, not sync_data alone.

SqlitePragmas

StorageProbe

Enums

FsClass

How suitable a filesystem is for a SQLite database that consensus writes to on every view.

Constants

BUDGET 🔒

CONTAINER_FS 🔒

FSYNC_ERROR 🔒

p50 fsync latency above which the disk is logged as ERROR. Deliberately far above anything healthy, because there is no validated threshold yet: ordinary cloud block storage sits at 0.5-2ms and ZFS on an encrypted volume at ~3ms, so a lower bar flags working nodes. At half a second per commit a single durable write already costs a quarter of a ~2s view. Everything below this is reported as a number and left to the operator.

LOCAL_FS 🔒

MAX_SAMPLES 🔒

MOUNTINFO_PATH 🔒

NETWORK_FS 🔒

Filesystem types where POSIX advisory locking is unreliable: remote/distributed filesystems, the FUSE drivers that proxy to one, and the host-shared mounts Docker Desktop, Colima, Lima and VirtualBox use to bind a directory from outside the VM/container. Other fuse.* drivers (e.g. fuse.gocryptfs, fuse.bindfs) are local-backed, so they fall through to FsClass::Unknown instead.

PROBE_TIMEOUT 🔒

Hard ceiling on the whole blocking half of the probe. Sampling is bounded to BUDGET, so only an unresponsive filesystem gets near this: a single uninterruptible fdatasync or stat against a dead hard-mounted NFS server. Reaching it aborts startup, because a node that cannot touch its data directory cannot persist consensus state either.

VOLATILE_FS 🔒

Functions

classify_fs 🔒

Unrecognized filesystem types are FsClass::Unknown rather than assumed local; asserting safety for a filesystem this probe has never seen would defeat the point of probing.

fs_class_label 🔒

fsync_probe 🔒

Writes and syncs a scratch file inside dir, sized to page_size (SQLite’s own page size, or 4096 if unknown), and returns fsync latency stats. The file is written and synced once before sampling to preallocate its page; each sample then seeks back to the start and overwrites in place, mirroring SQLite’s steady-state writes rather than growing the file every iteration, so that sync_data (fdatasync on Linux) need not flush changed metadata such as file size.

log_fs_info 🔒

parse_mountinfo 🔒

Longest mount point that is a prefix of path. path is already canonicalized.

parse_mountinfo_line 🔒

Parses one /proc/self/mountinfo line into (mount_point, fs_type, source).

probe

Runs the blocking half on a dedicated thread under PROBE_TIMEOUT, and returns an error if it expires. canonicalize is inside that half deliberately: stat on a hung hard mount blocks uninterruptibly, so the classification can hang before the fsync probe is even reached.

resolve_fs_info 🔒

unknown_fs_info 🔒