Alastair Burt writes:
1) Is it, indeed, possible for Zope to keep serving requests from a Data.fs that will not be usable when Zope restarts? Sure: Zope usually is interested only in some transaction records from the ZODB (the current versions). It maintains them in an internal data structure. When later a transaction record is corrupted, Zope can continue to work but after a restart reconstruction of this data structure is no longer possible...
2) How do people sleep at night knowing this to be the case? I would expect that with good hardware it should be very rare that file content changes automatically. I have seen 2 cases in 14 years... .... Footnotes: [1] I think my scripts to automatically start up Zope in event of a crash may have led to two instances of Zope trying to serve the same Data.fs. It should not be possible that two Zopes work on the same "Data.fs" because Zope locks this file. Exceptions may be when "Data.fs" is share across processors and cross processor locks are not handles correctly.
Dieter