The 52GB debug.log example is a very realistic way to show why rm returning instantly means nothing while a process still holds the file descriptor. The df versus du mismatch is usually the first clue, so having that next to the triage playbook is handy. The O_APPEND caveat is a good addition too, since truncating through the open descriptor behaves differently depending on how the writer opened the file.