Function sweep_orphaned_tmp 

pub fn sweep_orphaned_tmp(root: &Path) -> Result<u64>

Remove crash-orphaned *.tmp files under root, recursively.

The RAII unlink in write_atomic/TempPathGuard cannot run when the process is SIGKILLed between create_new and rename, so crash loops accumulate orphaned temp files linearly forever (empirically: 16 stranded temps across a 19-SIGKILL stress run, surviving every recovery pass) — the exact inode-exhaustion class the module doc promises to prevent. Callers MUST invoke this only at boot, before any concurrent writer exists, because a live writer’s in-flight temp is indistinguishable from an orphan. UUIDv7 suffixes guarantee a name deleted here can never be re-created by a later writer.

Returns the number of files removed. Errors on individual entries are skipped (a temp that cannot be removed is the pre-existing condition, not a boot failure); only the root read errors surface.