fix(metrics): an unreadable quota is not the whole volume #63

2026-09-15T10:18:56+02:00

mi commented

2026-09-15 10:18:56 +02:00

The production instance recorded a disk peak of 447.36 GiB against a
20.00 GiB quota, and the System page began advising an upgrade with
"peak 447.36 of 20.00 GiB (2237 %)". Both disks showed it, both from a
single sample.

That sample fell into a window where the JVM could not spawn any child
process, so the quota command did not run. The disk measurement did not
fail with it — it measured something else. An absent quota and an
unaskable one both arrived as an empty list, and an empty list means
"the volume is the budget". The volume is the shared disk this
installation holds a slice of, hence 447 GiB where 7 belonged.

The damage outlives the outage by a month: the sizing advice reads the
peak of the retention window, so a few unreadable seconds recommend an
upgrade for thirty days.

The reading now keeps its third state. null means the quota could not be
asked for, an empty list means it was asked and had nothing to say, and
a disk that was last bound to a quota is measured against nothing rather
than against its volume. A machine that has no quota at all keeps being
measured against its volume, which is the only sensible reading there
and is what the two existing tests still assert.

The persisted source key keeps its exact spelling; a new one would
restart every installation's disk series once.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

The production instance recorded a disk peak of 447.36 GiB against a 20.00 GiB quota, and the System page began advising an upgrade with "peak 447.36 of 20.00 GiB (2237 %)". Both disks showed it, both from a single sample. That sample fell into a window where the JVM could not spawn any child process, so the quota command did not run. The disk measurement did not fail with it — it measured something else. An absent quota and an unaskable one both arrived as an empty list, and an empty list means "the volume is the budget". The volume is the shared disk this installation holds a slice of, hence 447 GiB where 7 belonged. The damage outlives the outage by a month: the sizing advice reads the peak of the retention window, so a few unreadable seconds recommend an upgrade for thirty days. The reading now keeps its third state. null means the quota could not be asked for, an empty list means it was asked and had nothing to say, and a disk that was last bound to a quota is measured against nothing rather than against its volume. A machine that has no quota at all keeps being measured against its volume, which is the only sensible reading there and is what the two existing tests still assert. The persisted source key keeps its exact spelling; a new one would restart every installation's disk series once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mi added 1 commit 2026-09-15 10:18:56 +02:00

fix(metrics): an unreadable quota is not the whole volume

werkator build succeeded after 02:16

Details

f4fd6b7b70

The production instance recorded a disk peak of 447.36 GiB against a
20.00 GiB quota, and the System page began advising an upgrade with
"peak 447.36 of 20.00 GiB (2237 %)". Both disks showed it, both from a
single sample.

That sample fell into a window where the JVM could not spawn any child
process, so the quota command did not run. The disk measurement did not
fail with it — it measured something else. An absent quota and an
unaskable one both arrived as an empty list, and an empty list means
"the volume is the budget". The volume is the shared disk this
installation holds a slice of, hence 447 GiB where 7 belonged.

The damage outlives the outage by a month: the sizing advice reads the
peak of the retention window, so a few unreadable seconds recommend an
upgrade for thirty days.

The reading now keeps its third state. null means the quota could not be
asked for, an empty list means it was asked and had nothing to say, and
a disk that was last bound to a quota is measured against nothing rather
than against its volume. A machine that has no quota at all keeps being
measured against its volume, which is the only sensible reading there
and is what the two existing tests still assert.

The persisted source key keeps its exact spelling; a new one would
restart every installation's disk series once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mi merged commit 9a5eff2298 into main

2026-09-15 10:22:09 +02:00

mi deleted branch quota-read-failure

2026-09-15 10:22:09 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkator#63