[PATCH docs v2 3/5] storage: document NVMe all-path loss policy

[Joaquin Varela <joaquinvarela@neatech.ar>]

Describe queue-until-controller-loss and optional fast-I/O-fail
behavior. Make the availability-versus-prompt-error trade-off
explicit and show an example without prescribing one policy for
every workload.

Signed-off-by: Joaquin Varela <joaquinvarela@neatech.ar>
---
 pve-storage-zfsnvme.adoc | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pve-storage-zfsnvme.adoc b/pve-storage-zfsnvme.adoc
index c9ae180..35f09f8 100644
--- a/pve-storage-zfsnvme.adoc
+++ b/pve-storage-zfsnvme.adoc
@@ -85,6 +85,13 @@ nvme-ctrl-loss-tmo::
 How long a controller remains reconnectable after path loss. `-1` retries
 indefinitely.
 
+nvme-fast-io-fail-tmo::
+
+Optional time in seconds before outstanding I/O fails while a controller is
+reconnecting. If this property is absent, the kernel queues I/O until
+`nvme-ctrl-loss-tmo` expires. A configured value must not exceed a finite
+controller-loss timeout. A value of `0` selects immediate fail-fast behavior.
+
 nvme-nr-io-queues::
 
 Optional number of I/O queues per controller.
@@ -111,6 +118,7 @@ zfsnvme: nvme-shared
         nvme-keep-alive-tmo 5
         nvme-reconnect-delay 2
         nvme-ctrl-loss-tmo 600
+        nvme-fast-io-fail-tmo 30
         content images
         shared 1
 ----
@@ -131,6 +139,13 @@ fencing before placing production guests on the storage. Use independent
 failure domains for the configured paths and make sure the ZFS target itself
 is not a single point of failure.
 
+Choose the all-path outage policy for the workload. The default configuration
+leaves `nvme-fast-io-fail-tmo` unset: transient outages can recover without
+guest block errors, but an I/O request can remain queued for as long as
+`nvme-ctrl-loss-tmo` (600 seconds in the example). Set a shorter fast-I/O-fail
+timeout when the application prefers a prompt block error over a long stall.
+This is a service-level decision, not a universally safer default.
+
 Online resize of a running guest disk is not supported. Stop the VM before
 resizing; the new size is detected when the block device is reopened.
 
-- 
2.54.0.windows.1