The Log Outruns the Crash
The Log Outruns the Crash
A crash does not wait for a convenient moment. It can land in the middle of any write — after some blocks of a change have reached disk and others haven't — and the filesystem that survives it has to explain what state it's actually in, not what state it was trying to reach. Write-ahead logging solves this by refusing to let the real, permanent data structures be touched first at all. Every intended change is written, completely, to an append-only log before a single byte of the actual metadata is modified — and only once that log entry is safely on disk does the real update proceed. A crash mid-update is survivable because recovery just replays whatever the log promised: either the whole entry is there and gets finished, or it isn't there at all and never happened. There is no in-between state to reason about, because the log was the description of intent, made durable before the intent was acted on.
Copy-on-write designs sidestep the whole problem by never overwriting in place. A modification writes its new version of a block to fresh, untouched space, and only the very last step — flipping a single root pointer to point at the new tree instead of the old one — actually changes what anyone can see. Crash before that flip and the old tree is still perfectly intact; crash after it and the new tree already was. Consistency isn't enforced by ordering writes carefully — it's guaranteed by making the moment of truth a single atomic pointer swap instead of a scattered set of edits.
Soft updates take a third road, tracking the dependencies between metadata writes in memory and simply sequencing disk writes so that nothing is ever written before something it logically depends on — no separate log required, just discipline about order.
Underneath all three sits the same blunt hardware fact: a disk's own cache will happily reorder writes for performance unless something explicitly forces a barrier — fsync, fdatasync, a cache flush — and every one of these designs is, in the end, an argument about how to survive a world where "written" and "durable" are not the same word.
Seed: Storage Engine Crash Consistency — Write-Ahead Logging / Journaling, Copy-on-Write, Soft Updates, POSIX fsync semantics.