Module volume 

Per-volume state: the slot the engine and the worker thread share (VolumeSlot), the index install rule, the journal checkpoint, and the snapshot save helper. The thread that drives the flow lives in worker.rs; the OS-effect seams it runs against live in seams.rs.

Structs

JournalCheckpoint 🔒

USN position paired with the index state, shared with Engine::flush. The tailing thread owns the journal handle; “save now” from another thread needs (journal_id, next_usn) without touching it. Updated after a batch is applied, so a concurrent flush that reads the checkpoint first always saves checkpoint ≤ index — the USN replay on load covers the gap (re-applying records is idempotent; skipping them would not be).

VolumeQueryCache 🔒

Last materialized per-volume result, kept for incremental refinement (query/subsume.rs) and unchanged-result detection (QueryTrace:: unchanged). Validity = both generations still match; USN batches invalidate implicitly by bumping content_generation.

VolumeSlot 🔒

Enums

WorkerKind 🔒

What drives a volume slot: the privileged $MFT scan + USN journal, or the non-elevated folder-walk + ReadDirectoryChangesW watcher (scope mode, ADR-0024). The worker reuses one loop for both; this picks the initial-scan source and the change source at the two branch points.

Functions

is_valid_volume_label 🔒

A drive label is exactly one ASCII letter followed by ':' (“C:”, “d:”) — the shape list_ntfs_volumes produces and snapshot_path expects. This is the trust boundary for Engine::index_start: validating here bounds the set of distinct labels to a small finite set (so a hostile caller can’t spawn unbounded volume threads) and stops a label bearing ..\ or path separators from steering snapshot_path outside the index directory.

snapshot_path 🔒

{index_dir}\{drive-letter}.fmfidx — the path each volume’s WinSnapshotStore is built on.