A failed unlink still counts its bytes as reclaimed
Defect 2 / Tier 1 / issue
services/proxy/src/sweep.rs:125-137Expected review
only account for the removal when `remove_file` succeeded, treating `NotFound` as success.
Discovery difficulty
the comment gives a real and common reason for the error - a purge, or another proxy got there first - and for that reason ignoring it is correct. It is the accounting sitting after the `if let Err` rather than inside the success path that is wrong, and nothing draws the eye to it.
Trigger
a blob directory remounted read-only, or one whose leaf directories have lost write permission. Every unlink fails with `EROFS` or `EACCES`, `remaining` still falls below the ceiling so the loop stops taking candidates, the route answers with a byte total, and nothing was freed. `cairn_proxy_sweep_bytes_reclaimed_total` counts bytes that are still on disk, so the one metric an operator would watch is the one hiding it.
Severity
issue