Bug: Pinned chunks can be evicted from storage despite pin protection

[crtahlin]

Summary

Pinned chunks are not protected from eviction processes, causing permanent data loss when batches expire or storage pressure triggers evictions. This violates the fundamental guarantee that pinned data should persist until explicitly unpinned.

Expected Behavior

Pinned chunks should be excluded from all eviction processes:

• Batch expiry evictions
• Storage pressure evictions
• Manual batch evictions via EvictBatch() API

Current Behavior

Pinned chunks are evicted along with other chunks when:

1. Their postage batch expires
2. Storage capacity triggers reserve evictions
3. Manual batch eviction is called

After eviction, pin collections reference non-existent chunks, causing download failures with storage.ErrNotFound.

Root Cause

The eviction logic in pkg/storer/internal/reserve/reserve.go:330 (EvictBatchBin) never checks pin status before removing chunks:

  func (r *Reserve) EvictBatchBin(ctx context.Context, batchID []byte, count int, bin uint8) (int, error) {
      // Iterates through chunks and removes them without pin protection
      err := RemoveChunkWithItem(ctx, s, item)  // No HasPin() check
  }

Steps to Reproduce

1. Upload and pin content to a bee node
2. Wait for the postage batch to expire, OR trigger storage pressure
3. Attempt to download the pinned content
4. Observe storage.ErrNotFound errors despite pin status showing as active

Proposed Solution

Add pin protection checks to eviction paths:

1. In EvictBatchBin(): Before adding chunks to evicteditems, check if chunk address exists in any pin collection
2. In RemoveChunkWithItem(): Add safety check using HasPin() before deletion
3. Performance optimization: Consider caching pin status or maintaining a pin-protected chunk index

Required Changes

• Modify pkg/storer/internal/reserve/reserve.go eviction logic
• Add pin status checks in pkg/storer/internal/pinning/pinning.go
• Update eviction metrics to track pin-protected chunks
• Add integration tests covering pin-eviction scenarios

Impact

• High: Data loss for pinned content
• Affects: All nodes using pinning functionality
• Regression risk: Low (adding protection, not removing functionality)

Additional Context

This issue may be exacerbated during node upgrades when migration processes trigger eviction cleanup, explaining reports of pinned data loss after version upgrades.