There was an inherent race between the expiry thread and other file
deletions.

We solve this by making clear that expiry owns the reference. When
some user action requires deletion, expiry is set to "now" and the
file is removed from the index. We use the srvref as a marker
for index removal. After removal from the index, the file can
not be found any longer, so gaining an srvref is not possible.

When expiry is first to delete the file, the file is removed from
the index and the ref is lost.