In case of the underlying IO error, all bets are off. It might be useful to assume that not all the servers will not encounter IO error at the same time, so that we can let fs remount itself as readonly on the error, still providing read access to consumers, but redirect other writers elsewhere.