When the object store misbehaves at runtime (MinIO S3Error, a network blip, the bucket briefly down), the mounts service lets the raw store exception propagate untranslated. It lands in the generic intercept_exceptions handler and surfaces to the client as a 500, so "storage was briefly unavailable" reads as an application bug. The domain's 503 mapping for MountStorageUnavailable only fires when the bucket is unconfigured, not when a configured store fails mid-request. This is a pre-existing, domain-wide gap — not introduced by the drive-surfaces work — but that work adds new store call sites that widen it.
The goal is that transient/store-side failures translate to the right client error (503 for unavailable, an appropriate mount storage error otherwise) instead of a generic 500.
Follow-up from the #5400 backend review. Cited finding: 1.5 (raw store exceptions pass through the service untranslated, so a store outage reads as a 500; pre-existing gap, not chargeable to this PR). The review report is not in the repo, so this summary stands alone.
When the object store misbehaves at runtime (MinIO
S3Error, a network blip, the bucket briefly down), the mounts service lets the raw store exception propagate untranslated. It lands in the genericintercept_exceptionshandler and surfaces to the client as a 500, so "storage was briefly unavailable" reads as an application bug. The domain's 503 mapping forMountStorageUnavailableonly fires when the bucket is unconfigured, not when a configured store fails mid-request. This is a pre-existing, domain-wide gap — not introduced by the drive-surfaces work — but that work adds new store call sites that widen it.The goal is that transient/store-side failures translate to the right client error (503 for unavailable, an appropriate mount storage error otherwise) instead of a generic 500.
MountStorageUnavailable/MountStorageErrorin one place in the mounts domain, so every store call site (existing and new) benefits.Follow-up from the #5400 backend review. Cited finding: 1.5 (raw store exceptions pass through the service untranslated, so a store outage reads as a 500; pre-existing gap, not chargeable to this PR). The review report is not in the repo, so this summary stands alone.