[Karibhou]

A transient error reading the durable write counters previously caused the next flush to replace the all-time totals with only pending counts. Preserve the file and return the read error so pending counts are retried; continue recovering from invalid JSON as before.

The regression exercises an unreadable path, verifies it is not replaced, and checks that a subsequent retry retains the original totals and recorded-since timestamp. The existing corrupt-file test also checks the parse-error classification.

Fixes #14531

Validation: gofmt -l and git diff --check passed. Go tests are left to CI per AGENTS.md.

— hive: backend=codex

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Read src/crux/proxy/write_counters_store.go at 397aa2e and its callers. Looks correct to me.

• mergeIntoFile (lines 222-229) now only resets to newDurableWriteCounts() when errors.Is(err, errInvalidWriteCounts); any other read error returns before the write, so the durable file is never replaced on a transient I/O failure.
• flush (lines 206-218) already re-merges pending into c.pending on any error, and both callers (StartWriteCounterPersistence, lines 273-290) just log and retry on the next tick / final flush — so the returned read error turns into a retry, as the body says.
• MigrateWriteCounters (lines 162-176) inherits the change: an unreadable target file now leaves the legacy file in place instead of overwriting the target, which matches the function's documented intent.
• %w: %w is fine on this module's Go version; errors.Is(err, syscall.ELOOP) unwraps through *fs.PathError, and the self-referencing symlink gives a deterministic ELOOP even as root, so the new test is not flaky by construction.

CI is green; tide is the only pending context.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read src/crux/proxy/write_counters_store.go at the v5 merge-base alongside the diff.

What I verified

• flush (write_counters_store.go:204-218 at base) already re-merges pending into c.pending whenever mergeIntoFile returns an error, so returning the read error from mergeIntoFile (new :226-228) is sufficient to keep the pending counts for the next minute's retry — no change to flush is needed.
• LoadDurableWriteCounts keeps the os.ErrNotExist → empty-result path untouched, so a first-ever flush (no file yet) still creates the file; only EACCES/EIO/ELOOP-class read failures now propagate.
• The sentinel errInvalidWriteCounts is only attached on the json.Unmarshal branch, so the "corrupt file → start over" recovery is preserved exactly as before; the updated TestLoadDurableWriteCountsMissingAndCorrupt pins that classification.
• MigrateWriteCounters (:155-170) already returned read errors from the legacy load; this change makes the target load symmetric, which matches its doc comment ("a legacy file that cannot be read is left in place").
• %w: %w double-wrapping is fine on this module (go 1.26).
• Regression test: the self-referential symlink (os.Symlink(filepath.Base(path), path)) gives a deterministic ELOOP from os.ReadFile even as root; the asserted RecordedSince of 2026-10-12 is the UTC Monday of the recorded week, consistent with the existing EarliestWeek fallback.

One non-blocking note for the maintainer: #14531 also names the crux mirror (hivecommons/crux proxy/write_counters_store.go). This PR fixes hive only, which is right for a Fixes #14531 scoped to this repo — just flagging that the mirror will need the same two-line change if it is not synced automatically.

CI was still running at review time; nothing had failed.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#14532397aa2e` sha256:52db5ad20d46c8b04a3640dc9416e53f74e7dc5848638c7798f82fed04ed9629 — download from the dashboard or `hivectl review evidence #14532`.

[hivecommons-hive]

Merged by hive contributor-lane auto-merge: CI green for ≥30m, reviewer verdict approve, @Karibhou holds the trusted tier in this hive's contributor registry.