pub fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()>Expand description
Durably write bytes to path via create-tmp + fsync + rename + parent fsync.
The temporary file uses a UUIDv7-derived suffix to avoid collision with any
concurrent writer targeting the same final path, and is opened with
create_new so a stale suffix collision fails safely instead of clobbering.
Callers that already hold the parent directory pass any Path; missing
parents are created before the temp file is opened.
If any step between temp creation and rename fails, the temp file is
unlinked via an RAII guard so we never leak zero-byte .tmp files into
the spool. A repeatedly-failing writer would otherwise fill the inode
table on ext4/xfs long before the disk is full — an operational silent
death.
Ok(()) means both the file and its parent directory were successfully
synchronized on platforms supporting directory fsync. An error can occur
after rename: the complete new file may already be visible, but its
durability is uncertain. Callers must fail closed and retain that file for
recovery or an idempotent retry; an error does not mean the path is absent.
In particular, visibility alone is insufficient for an audit marker that
must survive a crash before an upstream request may be sent.