feat(worker): write-back skeleton — durable staging and flush queue

[beinan]

Closes #358. Part of #274 (roadmap item 4).

Why

The write path is strictly write-through today: talon-fuse buffers a whole object in client memory and, at flush/fsync, PUTs it through the owning worker, which uploads to the origin and then caches the bytes. The backend PUT is the durability point, so there is no worker-side dirty state to lose.

Write-back inverts that — acknowledge once the bytes are durable locally, upload afterwards — and needs machinery write-through never did. This PR builds that machinery as a self-contained module.

What

talon_worker::write_cache::WriteCache:

• Durable staging. Body and a JSON sidecar each go through Stager (staged write + fsync + atomic rename), plus a directory fsync. The sidecar is written after the body and is the commit marker, so an interrupt leaves either a complete entry or reclaimable garbage — never a pending entry pointing at a truncated body.
• Crash recovery. Startup rebuilds the pending set from committed sidecars, drops bodies whose sidecar never landed, keeps only the highest seq where several generations survived, reclaims corrupt sidecars, and resumes seq above the highest seen so numbers never repeat across a restart.
• Coalescing with an in-flight boundary. Repeat writes to one object collapse to a single pending entry. Once take_next hands an entry to the flusher it is immune to coalescing, so a hot object neither accumulates N uploads nor has its bytes pulled out from under an upload in progress.
• Failure handling. requeue retries a failed flush; if a newer generation was staged meanwhile, the failed one is discarded rather than moving the origin backwards. complete ignores a stale seq, so a late completion cannot retire newer data. An unreadable staged file is dropped loudly rather than wedging the queue.
• Read-your-writes. staged_bytes returns the newest staged generation, checksum-verified — corruption surfaces as an error, not as silently wrong data served in place of the origin.
• dirty_bytes() exposes acknowledged-but-not-yet-durable-at-the-origin bytes, the figure a write-back deployment has to alarm on.

Deliberately out of scope

• Not wired into WorkerRuntime or the serve path, and no config flag. Write-through remains the only reachable behavior. Whether Talon promises write-back at all is an ADR-level decision (roadmap: post-v1 direction — fail-open, cache admission, RDMA, write cache, freshness, and gaps #274 item 4, which also requires revisiting ADR 0001).
• Replication. NVMe alone is not durability; real write-back needs RF>=2 with synchronous replication before ack. This module is the local half.

Tests

16 unit tests covering staging, coalescing, the in-flight boundary, stale completions, requeue supersession, read-your-writes, checksum rejection, FIFO order, queue-wedging, and four recovery scenarios. just ci clean.

🤖 Generated with Claude Code