A future mtime becomes an age of zero, so those blobs are never evicted
Defect 5 / Tier 2 / issue
services/proxy/src/sweep.rs:185-190Expected review
treat an unreadable or future mtime as old rather than new, so a clock problem cannot make a blob permanently exempt.
Discovery difficulty
the doc comment argues the case for flattening the error, and the argument is sound - a sweep that refuses to run over one odd timestamp is worse than one that copes. The bug is the direction it flattens in, which the comment never mentions, and the symptom is a sweep that quietly does nothing rather than one that fails.
Trigger
a blob directory on a volume whose server clock runs ahead of the proxy's - an NFS mount a few seconds out, or a container host that has just stepped its clock. Every freshly written blob is exempt while the clock is ahead; on a volume minutes ahead it is the whole store. Verified: with both blobs' mtimes set 60 seconds into the future and a one-second minimum age, a sweep over a store at four times its ceiling reported `removed: 0`. The sweep runs on schedule, reports nothing reclaimed, and the disk fills.
Severity
issue