bedrock-kv / bedrock / 216164972bb2edc5c4348892e48f9fbcf40e1908

82%

Build Type

push

github

Committed by web-flow

Commit Message

A worker directory is one with a manifest; report the ones that are not (#213)

Closes bedrock-61c.2 (epic bedrock-61c).

`worker_paths_from_disk/1` globbed every entry under the foreman's path
and called each a worker. That path is shared — the cluster supervisor
derives `object_storage/` from the same `:path` it hands the foreman,
and every deployment config puts the coordinator's `raft/` alongside it.
Both landed in the worker map as `{:failed_to_start,
:manifest_does_not_exist}`, as did the remains of workers whose
manifests are gone.

### Why the orphans are stuck

Retirement runs **through** the worker: `Foreman.worker_retired/2` is
called by a live process holding the id and foreman ref that its
*manifest* supplied. A directory with no manifest starts no process, is
never judged displaced, and can never retire itself. It is retried and
re-failed on every boot while holding its disk, invisibly. On the
cluster that prompted this, that is 129 MB across three directories
untouched since a crash five days earlier.

### Changes
- key enumeration off the manifest's presence, single-sourced as
`WorkingDirectory.manifest_path/1`
- **absence is the only thing that excludes.** A corrupt manifest is a
worker in trouble; a manifest that cannot be stat'ed for any reason
other than absence is a worker we cannot rule out. Both stay enumerated
and surface as `:failed_to_start`, so no live worker vanishes from the
foreman's view because of a permissions mistake (`File.exists?/1`
returns `false` on `EACCES` — that hole is closed)
- report manifest-less directories by name at boot, and leave them alone

### Deliberately not reclaiming
The directory may hold a WAL, and deleting data on a guess is not the
foreman's call. There is no automatic reclamation path and this PR does
not add one — cleanup is the operator's, which is why the log names the
paths.

### Verification
2811 tests, 0 failures. Credo and dialyzer clean.

Adversarially audited by a cold agent. It cor... (continued)

Coverage Stats

15 of 16 new or added lines in 3 files covered. (93.75%)

16 existing lines in 3 files now uncovered.

6878 of 8696 relevant lines covered (79.09%)

1044.39 hits per line