Two proxies over one blob directory over-reclaim and double-count
Defect 19 / Tier 4 / issue
services/proxy/src/sweep.rs:10-12services/proxy/src/sweep.rs:65-67Expected review
take a lock the filesystem can enforce - a lock file or a lease under the blob directory - or recheck the size as the loop goes rather than deciding everything up front.
Discovery difficulty
the code names the risk and appears to have handled it, and for a single proxy it has. What makes the guard insufficient is a supported deployment shape recorded in a comment in a different file, and the symptom is a cache smaller than configured rather than anything that errors.
Trigger
two proxies on one volume, both on the default 15 minute interval, sweeping a store at 1.5 times the ceiling. Each reads `held`, each removes `held - ceiling`, and the store lands at `2 × ceiling - held` - half the intended cache. Both also call `record_sweep` for the same bytes, so the fleet's reclaimed total is roughly double the truth.
Severity
issue