tensorfs 0.3.67__tar.gz → 0.3.69__tar.gz

{tensorfs-0.3.67 → tensorfs-0.3.69}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.67"
+version = "0.3.69"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.67"
+version = "0.3.69"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.67 → tensorfs-0.3.69}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.67"
+version = "0.3.69"
 edition = "2021"

{tensorfs-0.3.67 → tensorfs-0.3.69}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.67
+Version: 0.3.69
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -257,6 +257,8 @@ fn pull_with_budget(
     flags: &Flags,
     budget: Option<(u64, u64)>,
 ) -> ExitCode {
+    // Before the open, which is where an unclean shutdown's recovery runs.
+    let before = tensorfs_core::stats::snapshot();
     let store = ok!(Store::open(root));
     let Some(base) = flag(flags, "hub") else {
         eprintln!("--hub <base-url> is required");
@@ -302,7 +304,6 @@ fn pull_with_budget(
     let observe = |_object: &ObjectRef, moved: u64, door: ObjectSource| progress.saw(moved, door);
     request.on_plan = Some(&planned);
     request.on_object = Some(&observe);
-    let before = tensorfs_core::stats::snapshot();
     let started = std::time::Instant::now();
     let report = ok!(transport::pull(&request));
     let seconds = started.elapsed().as_secs_f64();
@@ -333,9 +334,12 @@ fn pull_with_budget(
         })
         .collect();
     // And what admitting them cost: a pull whose streams stop growing while its batches
-    // take most of the wall time is held by the disk, not the link.
+    // take most of the wall time is held by the disk, not the link. `durability` says
+    // which syncs the disk the Store lives on made it pay, and what an unclean shutdown
+    // before this pull cost to repair.
+    let durability = &report.durability;
     eprintln!(
-        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"backoffs\":{},\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
+        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"backoffs\":{},\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}},\"durability\":{{\"class\":{},\"filesystem\":{},\"syncs\":{},\"sync_seconds\":{:.3},\"recovery\":{{\"rehashed\":{},\"removed\":{},\"seconds\":{:.3}}}}}}}",
         quoted(&report.model),
         seconds,
         report.bytes_moved,
@@ -345,6 +349,13 @@ fn pull_with_budget(
         after.admitted_objects - before.admitted_objects,
         after.admission_batches - before.admission_batches,
         (after.admission_nanos - before.admission_nanos) as f64 / 1e9,
+        quoted(durability.class.as_str()),
+        quoted(durability.filesystem),
+        durability.syncs,
+        durability.seconds,
+        after.recovery_rehashed - before.recovery_rehashed,
+        after.recovery_removed - before.recovery_removed,
+        (after.recovery_nanos - before.recovery_nanos) as f64 / 1e9,
     );
     println!(
         "model        {}@{} lane {}",

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -904,6 +904,11 @@ fn cmd_store(root: &Path, verb: &str, flags: &Flags) -> ExitCode {
             None => "(none)".to_string(),
         }
     );
+    println!(
+        "durability: {} ({})",
+        s.disk_class().as_str(),
+        s.disk().kind
+    );
     ExitCode::SUCCESS
 }
 

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/derived/part_rows_tests.rs

@@ -324,3 +324,50 @@ fn an_indexed_checkpoint_does_not_reread_its_chain() {
     release_guards(&meta, Some(writer.writer_hold), writer.source_leases);
     std::fs::remove_dir_all(store.root()).unwrap();
 }
+
+#[test]
+fn a_digest_receipt_names_the_declaration_the_intent_bound() {
+    let (store, meta, id, declaration) = fixture("receipt-digest");
+    let intent = declaration.clone().canonical_work_bytes().unwrap();
+    let writer = begin(&store, &meta, &id, 1, declaration, None).unwrap();
+    for (index, key) in ["weight_0", "weight_1", "weight_2"].into_iter().enumerate() {
+        add(&store, &meta, &id, &writer, key, index as u8 + 1).unwrap();
+    }
+    let receipt = commit(&store, &meta, &id, 1).unwrap();
+    let inline = receipt.value(ReceiptDeclaration::Inline);
+    let digest = receipt.value(ReceiptDeclaration::Digest);
+    assert_eq!(inline, receipt.to_value());
+    let field = |value: &Value, name: &str| {
+        as_obj("receipt", "facts", value)
+            .unwrap()
+            .iter()
+            .find(|(key, _)| key == name)
+            .map(|(_, value)| value.clone())
+    };
+    assert_eq!(
+        crate::canon::write(&field(&inline, "declaration").unwrap()),
+        intent
+    );
+    assert!(field(&digest, "declaration").is_none());
+    assert_eq!(
+        field(&digest, "declaration_digest"),
+        Some(Value::str(ObjectRef::of(&intent).id()))
+    );
+    assert_eq!(
+        field(&digest, "declaration_length"),
+        Some(Value::uint(intent.len() as u64))
+    );
+    // Every other fact is identical in both forms.
+    let others = |value: &Value| {
+        as_obj("receipt", "facts", value)
+            .unwrap()
+            .iter()
+            .filter(|(key, _)| !key.starts_with("declaration"))
+            .cloned()
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(others(&inline), others(&digest));
+    let _ = fence(&meta, &id, 1);
+    release_guards(&meta, Some(writer.writer_hold), writer.source_leases);
+    std::fs::remove_dir_all(store.root()).unwrap();
+}

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/derived/retention.rs

@@ -5,7 +5,8 @@ use std::io::{Read, Write};
 use std::path::PathBuf;
 
 use super::{
-    checkpoint, receipt_from, require_payload_record, roots, Disposition, TransactionState,
+    checkpoint, receipt_from, require_payload_record, roots, Disposition, ReceiptDeclaration,
+    TransactionState,
 };
 use crate::canon::{Fields, Value};
 use crate::catalog::WriterGuard;
@@ -217,7 +218,12 @@ pub fn retain_result(
         );
     }
     let facts = receipt_from(store, row)?;
-    if object_id(&crate::canon::write(&facts.to_value())) != receipt {
+    // A receipt's identity is the digest of whichever form its caller was handed.
+    let forms = [ReceiptDeclaration::Inline, ReceiptDeclaration::Digest];
+    if !forms
+        .iter()
+        .any(|form| object_id(&crate::canon::write(&facts.value(*form))) == receipt)
+    {
         return refuse(
             Code::OBJECT_ID_MISMATCH,
             "retained result receipt differs from committed computation",
@@ -369,6 +375,29 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_result_is_retained_under_either_receipt_form_and_nothing_else() {
+        let f = fixture();
+        let facts = derived::lookup(&f.store, &f.meta, &f.transaction).unwrap();
+        let derived::Lookup::Committed(committed) = facts else {
+            panic!("committed result expected")
+        };
+        let digest_form = object_id(&crate::canon::write(
+            &committed.receipt().value(ReceiptDeclaration::Digest),
+        ));
+        assert_ne!(digest_form, f.receipt);
+        let retained =
+            retain_result(&f.store, &f.meta, &f.transaction, &digest_form, &id("b1")).unwrap();
+        assert_eq!(retained.receipt_digest, digest_form);
+        retain_result(&f.store, &f.meta, &f.transaction, &f.receipt, &id("b2")).unwrap();
+        assert_eq!(
+            retain_result(&f.store, &f.meta, &f.transaction, &id("99"), &id("b3"))
+                .unwrap_err()
+                .code,
+            Code::OBJECT_ID_MISMATCH
+        );
+    }
+
     #[test]
     fn independent_owners_keep_original_bytes_and_receipt_through_disposal_and_gc() {
         let f = fixture();

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/derived.rs

@@ -3421,8 +3421,38 @@ pub struct ReceiptFacts {
     pub inherited_payload_bytes: u64,
 }
 
+/// How a receipt names its declaration: the whole document, or its digest and length.
+/// The whole document grows with the tensors declared; a digest keeps receipts constant.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum ReceiptDeclaration {
+    #[default]
+    Inline,
+    Digest,
+}
+
 impl ReceiptFacts {
     pub fn to_value(&self) -> Value {
+        self.value(ReceiptDeclaration::Inline)
+    }
+
+    pub fn value(&self, form: ReceiptDeclaration) -> Value {
+        let mut value = self.inline_value();
+        if form == ReceiptDeclaration::Digest {
+            if let Value::Obj(fields) = &mut value {
+                let bytes = crate::canon::write(&self.declaration.to_value());
+                fields.retain(|(key, _)| key != "declaration");
+                fields.push((
+                    "declaration_digest".into(),
+                    Value::str(ObjectRef::of(&bytes).id()),
+                ));
+                fields.push(("declaration_length".into(), Value::uint(bytes.len() as u64)));
+                fields.sort_by(|left, right| left.0.cmp(&right.0));
+            }
+        }
+        value
+    }
+
+    fn inline_value(&self) -> Value {
         Value::obj(vec![
             (
                 "added_objects",

tensorfs-0.3.69/crates/tensorfs-core/src/disk.rs

@@ -0,0 +1,153 @@
+//! What a crash can take from a Store, read off the filesystem the Store actually lives on.
+//!
+//! An fsync protects bytes against the machine going down before its page cache is written.
+//! Whether that protection is worth paying for depends on where the bytes live, and only the
+//! mount can say that — never a flag, never an environment variable.
+//!
+//! The rule, from `statfs(2)` of the Store root (Linux):
+//!
+//! - **Ephemeral** — tmpfs, ramfs, overlayfs. RAM, or a container's writable layer, which the
+//!   platform discards with the machine or container (a RunPod container disk is erased when
+//!   the pod stops). Nothing a crash could leave behind is ever read again, and a process
+//!   crash leaves the page cache intact, so no fsync buys anything.
+//! - **Network** — NFS, SMB/CIFS, FUSE, Ceph, 9p, AFS, Coda, GFS2, OCFS2, Lustre, GPFS.
+//!   Another machine may read it, and close-to-open is the only ordering that machine sees:
+//!   bytes are flushed before their name is published, as before.
+//! - **Persistent** — everything else (ext4, xfs, btrfs, zfs, ...), a `statfs` that fails,
+//!   and every non-Linux platform. The safe side: it survives a crash of this machine.
+
+use std::path::Path;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum DiskClass {
+    Ephemeral,
+    Persistent,
+    Network,
+}
+
+impl DiskClass {
+    /// The class of the filesystem holding `path`.
+    pub fn of(path: &Path) -> DiskClass {
+        filesystem(path).class
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            DiskClass::Ephemeral => "ephemeral",
+            DiskClass::Persistent => "persistent",
+            DiskClass::Network => "network",
+        }
+    }
+}
+
+/// The filesystem holding a path: its class and the name it was recognised by.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Filesystem {
+    pub class: DiskClass,
+    /// `ext4`, `overlayfs`, `nfs`, ...; `other` for an unrecognised magic, `unknown` when
+    /// `statfs` failed or the platform has no magic.
+    pub kind: &'static str,
+}
+
+#[cfg(target_os = "linux")]
+pub fn filesystem(path: &Path) -> Filesystem {
+    match rustix::fs::statfs(path) {
+        #[allow(clippy::unnecessary_cast)]
+        Ok(stat) => classify((stat.f_type as u64) & 0xffff_ffff),
+        Err(_) => Filesystem {
+            class: DiskClass::Persistent,
+            kind: "unknown",
+        },
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+pub fn filesystem(_path: &Path) -> Filesystem {
+    Filesystem {
+        class: DiskClass::Persistent,
+        kind: "unknown",
+    }
+}
+
+/// Superblock magics from `linux/magic.h` and the filesystems' own headers.
+#[cfg(target_os = "linux")]
+fn classify(magic: u64) -> Filesystem {
+    use DiskClass::*;
+    let (class, kind) = match magic {
+        0x0102_1994 => (Ephemeral, "tmpfs"),
+        0x8584_58f6 => (Ephemeral, "ramfs"),
+        0x794c_7630 => (Ephemeral, "overlayfs"),
+        0x6969 => (Network, "nfs"),
+        0x517b => (Network, "smb"),
+        0xff53_4d42 => (Network, "cifs"),
+        0xfe53_4d42 => (Network, "smb2"),
+        0x6573_5546 => (Network, "fuse"),
+        0x00c3_6400 => (Network, "ceph"),
+        0x0102_1997 => (Network, "9p"),
+        0x5346_414f | 0x6b41_4653 => (Network, "afs"),
+        0x7375_7245 => (Network, "coda"),
+        0x0116_1970 => (Network, "gfs2"),
+        0x7461_636f => (Network, "ocfs2"),
+        0x0bd0_0bd0 => (Network, "lustre"),
+        0x4750_4653 => (Network, "gpfs"),
+        0xef53 => (Persistent, "ext4"),
+        0x5846_5342 => (Persistent, "xfs"),
+        0x9123_683e => (Persistent, "btrfs"),
+        0x2fc1_2fc1 => (Persistent, "zfs"),
+        0xf2f5_2010 => (Persistent, "f2fs"),
+        _ => (Persistent, "other"),
+    };
+    Filesystem { class, kind }
+}
+
+/// This kernel's boot, or `None` where there is no such identity. Page cache belongs to a
+/// boot: bytes written under this boot and not yet on disk are still readable until it ends.
+/// A container sees its host's boot, which is the one that owns the page cache.
+pub(crate) fn boot_id() -> Option<String> {
+    #[cfg(target_os = "linux")]
+    {
+        let id = std::fs::read_to_string("/proc/sys/kernel/random/boot_id").ok()?;
+        let id = id.trim();
+        (id.len() == 36 && id.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-'))
+            .then(|| id.to_string())
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn magics_name_their_class() {
+        assert_eq!(classify(0x794c_7630).class, DiskClass::Ephemeral);
+        assert_eq!(classify(0x0102_1994).class, DiskClass::Ephemeral);
+        assert_eq!(classify(0x6969).class, DiskClass::Network);
+        assert_eq!(classify(0x6573_5546).class, DiskClass::Network);
+        assert_eq!(classify(0xef53).class, DiskClass::Persistent);
+        assert_eq!(classify(0x1234_5678).class, DiskClass::Persistent);
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn real_mounts_classify() {
+        if Path::new("/dev/shm").is_dir() {
+            assert_eq!(filesystem(Path::new("/dev/shm")).kind, "tmpfs");
+            assert_eq!(DiskClass::of(Path::new("/dev/shm")), DiskClass::Ephemeral);
+        }
+        assert_eq!(
+            DiskClass::of(Path::new("/proc/self")),
+            DiskClass::Persistent,
+            "an unrecognised filesystem is the safe side"
+        );
+        assert_eq!(
+            DiskClass::of(Path::new("/no/such/path/anywhere")),
+            DiskClass::Persistent
+        );
+        assert!(boot_id().is_some());
+    }
+}

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/lib.rs

@@ -20,6 +20,7 @@ pub mod checkpoint_root;
 pub mod corpus;
 pub mod derived;
 pub mod descriptors;
+pub mod disk;
 pub mod dtype;
 pub mod durability;
 pub mod err;
@@ -53,6 +54,7 @@ pub mod stats;
 pub mod storage;
 pub mod store;
 pub mod transport;
+pub mod unsynced;
 pub mod vectors;
 
 /// This TensorFS's release version.

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/staging.rs

@@ -204,7 +204,9 @@ pub fn stage<R: Read>(store: &Store, r: &mut R, want: &ObjectRef) -> Result<Carr
             return Err(io(format!("link {}", destination.display()), error));
         }
     }
-    crate::store::fsync_dir(&dir)?;
+    if store.flushes() {
+        crate::store::fsync_dir(&dir)?;
+    }
     let _ = fs::remove_file(&verified.tmp);
     drop(verified.file);
     Ok(Carrier {

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/stats.rs

@@ -9,6 +9,11 @@ static REPO_CACHE_VERIFIED_READS: AtomicU64 = AtomicU64::new(0);
 static ADMISSION_BATCHES: AtomicU64 = AtomicU64::new(0);
 static ADMITTED_OBJECTS: AtomicU64 = AtomicU64::new(0);
 static ADMISSION_NANOS: AtomicU64 = AtomicU64::new(0);
+static SYNCS: AtomicU64 = AtomicU64::new(0);
+static SYNC_NANOS: AtomicU64 = AtomicU64::new(0);
+static RECOVERY_REHASHED: AtomicU64 = AtomicU64::new(0);
+static RECOVERY_REMOVED: AtomicU64 = AtomicU64::new(0);
+static RECOVERY_NANOS: AtomicU64 = AtomicU64::new(0);
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct Stats {
@@ -24,6 +29,14 @@ pub struct Stats {
     pub admitted_objects: u64,
     /// Wall time those batches spent linking, fsyncing and committing.
     pub admission_nanos: u64,
+    /// Filesystem syncs pulls ran on persistent disks, and their wall time.
+    pub syncs: u64,
+    pub sync_nanos: u64,
+    /// Objects rehashed after an unclean shutdown, those found torn and removed, and the
+    /// wall time the recovery took.
+    pub recovery_rehashed: u64,
+    pub recovery_removed: u64,
+    pub recovery_nanos: u64,
 }
 
 pub fn snapshot() -> Stats {
@@ -34,6 +47,11 @@ pub fn snapshot() -> Stats {
         admission_batches: ADMISSION_BATCHES.load(Ordering::Relaxed),
         admitted_objects: ADMITTED_OBJECTS.load(Ordering::Relaxed),
         admission_nanos: ADMISSION_NANOS.load(Ordering::Relaxed),
+        syncs: SYNCS.load(Ordering::Relaxed),
+        sync_nanos: SYNC_NANOS.load(Ordering::Relaxed),
+        recovery_rehashed: RECOVERY_REHASHED.load(Ordering::Relaxed),
+        recovery_removed: RECOVERY_REMOVED.load(Ordering::Relaxed),
+        recovery_nanos: RECOVERY_NANOS.load(Ordering::Relaxed),
     }
 }
 
@@ -69,3 +87,18 @@ pub(crate) fn admission_batch(objects: usize, spent: std::time::Duration) {
         Ordering::Relaxed,
     );
 }
+
+fn nanos(spent: std::time::Duration) -> u64 {
+    u64::try_from(spent.as_nanos()).unwrap_or(u64::MAX)
+}
+
+pub(crate) fn synced(spent: std::time::Duration) {
+    SYNCS.fetch_add(1, Ordering::Relaxed);
+    SYNC_NANOS.fetch_add(nanos(spent), Ordering::Relaxed);
+}
+
+pub(crate) fn recovered(recovery: &crate::unsynced::Recovery, spent: std::time::Duration) {
+    RECOVERY_REHASHED.fetch_add(recovery.rehashed, Ordering::Relaxed);
+    RECOVERY_REMOVED.fetch_add(recovery.removed, Ordering::Relaxed);
+    RECOVERY_NANOS.fetch_add(nanos(spent), Ordering::Relaxed);
+}

{tensorfs-0.3.67 → tensorfs-0.3.69}/crates/tensorfs-core/src/store.rs

@@ -8,7 +8,10 @@
 //!
 //! Admission is `writing → verified-temp → installed`: temp in `tmp/`, hash while writing,
 //! fsync, 0444, then a no-clobber `link()` into place plus a parent-directory fsync. A
-//! crash at any stage leaves a temp, never a partial object under `objects/`.
+//! crash at any stage leaves a temp, never a partial object under `objects/`. Which of those
+//! syncs an admission pays depends on the disk the Store lives on ([`crate::disk`]): none on
+//! an ephemeral one, and on a persistent one none inside a pull, whose batch sync
+//! covers them ([`crate::unsynced`]).
 //!
 //! `contains` is a PRESENCE HINT and nothing more. Trusting bytes requires a durable
 //! verification record bound to object id, length, file identity (dev, ino), size and
@@ -305,6 +308,10 @@ pub struct Store {
     budget: Option<u64>,
     /// This process's verified-blob index for the catalog, shared with every other handle.
     trust: std::sync::Arc<crate::catalog::Trust>,
+    /// The filesystem this Store lives on, and so what a crash can take from it.
+    disk: crate::disk::Filesystem,
+    /// The pull whose batch sync covers this handle's admissions (persistent disk).
+    epoch: Option<std::sync::Arc<crate::unsynced::Epoch>>,
 }
 
 impl std::fmt::Debug for Store {
@@ -313,6 +320,7 @@ impl std::fmt::Debug for Store {
             .field("root", &self.root)
             .field("observed", &self.progress.is_some())
             .field("repo_cache", &self.cache.as_ref().map(|c| c.root()))
+            .field("disk", &self.disk)
             .finish()
     }
 }
@@ -518,6 +526,8 @@ impl Store {
             cache: read_repo_cache_binding(root),
             budget: read_disk_budget(root),
             trust: crate::catalog::Trust::of(root),
+            disk: crate::disk::filesystem(root),
+            epoch: None,
         })
     }
 
@@ -549,6 +559,45 @@ impl Store {
         &self.root
     }
 
+    /// The filesystem this Store lives on. See [`crate::disk`].
+    pub fn disk(&self) -> crate::disk::Filesystem {
+        self.disk
+    }
+
+    pub fn disk_class(&self) -> crate::disk::DiskClass {
+        self.disk.class
+    }
+
+    /// Whether an admission makes its own bytes and name durable before it reports: not on
+    /// an ephemeral disk, and not under a pull's epoch, whose batch sync covers them.
+    pub(crate) fn flushes(&self) -> bool {
+        match self.disk.class {
+            crate::disk::DiskClass::Ephemeral => false,
+            crate::disk::DiskClass::Network => true,
+            crate::disk::DiskClass::Persistent => self.epoch.is_none(),
+        }
+    }
+
+    /// The same Store, its admissions covered by `epoch`.
+    pub(crate) fn syncing(&self, epoch: Option<std::sync::Arc<crate::unsynced::Epoch>>) -> Store {
+        Store {
+            epoch,
+            ..self.clone()
+        }
+    }
+
+    /// The same Store as if it lived on a disk of `class`: benchmarks of one real disk.
+    #[cfg(test)]
+    pub(crate) fn with_disk_class(self, class: crate::disk::DiskClass) -> Store {
+        Store {
+            disk: crate::disk::Filesystem {
+                class,
+                kind: "injected",
+            },
+            ..self
+        }
+    }
+
     pub(crate) fn trust(&self) -> &crate::catalog::Trust {
         &self.trust
     }
@@ -867,12 +916,14 @@ impl Store {
                 child
                     .set_permissions(fs::Permissions::from_mode(0o755))
                     .map_err(|error| io("set public Store directory mode", error))?;
-                child
-                    .sync_all()
-                    .map_err(|error| io("sync public Store directory", error))?;
-                parent
-                    .sync_all()
-                    .map_err(|error| io("sync public directory parent", error))?;
+                if self.flushes() {
+                    child
+                        .sync_all()
+                        .map_err(|error| io("sync public Store directory", error))?;
+                    parent
+                        .sync_all()
+                        .map_err(|error| io("sync public directory parent", error))?;
+                }
             } else if metadata.uid() != owner.uid() || metadata.gid() != owner.gid() {
                 return refuse(
                     Code::STORE_ERA,
@@ -1072,8 +1123,10 @@ impl Store {
             .map_err(|error| io("create manifest temp", error))?;
         file.write_all(&bytes)
             .map_err(|error| io("write manifest", error))?;
-        file.sync_all()
-            .map_err(|error| io("fsync manifest", error))?;
+        if self.flushes() {
+            file.sync_all()
+                .map_err(|error| io("fsync manifest", error))?;
+        }
         fs::set_permissions(&temporary, fs::Permissions::from_mode(0o444))
             .map_err(|error| io("chmod manifest", error))?;
         let admitted = match fs::hard_link(&temporary, &path) {
@@ -1082,9 +1135,12 @@ impl Store {
             Err(error) => return cleanup(&temporary, io("install manifest", error)),
         };
         let _ = fs::remove_file(&temporary);
-        if admitted {
+        if admitted && self.flushes() {
             fsync_dir(path.parent().unwrap())?;
         }
+        if let (true, Some(epoch)) = (admitted, &self.epoch) {
+            epoch.admitted(path.clone(), object.length)?;
+        }
         self.read_manifest(&object)?;
         Ok(Put {
             obj: object,
@@ -1404,8 +1460,10 @@ impl Store {
             }
         }
         fault.hit("written");
-        if let Err(e) = f.sync_all() {
-            return cleanup(&tmp, io("fsync temp", e));
+        if self.flushes() {
+            if let Err(e) = f.sync_all() {
+                return cleanup(&tmp, io("fsync temp", e));
+            }
         }
         fault.hit("fsync");
 
@@ -1483,13 +1541,18 @@ impl Store {
         };
         let publish = move || {
             let installed = self.link_verified(&verified, fault)?;
-            if let Some(dir) = &installed {
+            if let Some(dir) = installed.as_ref().filter(|_| self.flushes()) {
                 if let Err(error) = fsync_dir(dir) {
                     let _ = fs::remove_file(&verified.tmp);
                     return Err(error);
                 }
             }
-            self.finish_linked(verified, installed.is_some())
+            let length = verified.length;
+            let record = self.finish_linked(verified, installed.is_some())?;
+            if let (Some(epoch), Some(record)) = (&self.epoch, &record) {
+                epoch.admitted(self.object_path(&record.sha256), length)?;
+            }
+            Ok(record)
         };
         let admitted = match operation {
             Some(operation) => catalog.admit_blob(Some(operation), &object, publish)?,
@@ -2143,15 +2206,20 @@ fn creation_lock(root: &Path) -> Result<File> {
     Ok(directory)
 }
 
+/// No handle is returned while an unclean shutdown's unsynced admissions are unverified.
 fn open_validated(root: &Path) -> Result<Store> {
     fs::create_dir_all(root.join("tmp")).map_err(|error| io("mkdir tmp", error))?;
-    Ok(Store {
+    let store = Store {
         root: root.to_path_buf(),
         progress: None,
         cache: read_repo_cache_binding(root),
         budget: read_disk_budget(root),
         trust: crate::catalog::Trust::of(root),
-    })
+        disk: crate::disk::filesystem(root),
+        epoch: None,
+    };
+    crate::unsynced::recover(&store)?;
+    Ok(store)
 }
 
 fn open_real_directory(path: &Path) -> Result<File> {