fix(downloads): clean reservations when ownership writes fail

This commit is contained in:
4gray committed 2026-09-08 05:22:04 +02:00
1 parent 1dfafb404d
commit 4f55bc5e66
3 files changed
+59 -3

No files matched your search

+5 -2
View File
@@ -118,8 +118,11 @@ filesystems without hardlinks. Cleanup remains synchronous after the
runtime guard, so a completion transition cannot interleave with unlink.
Missing archive re-downloads claim a fresh reservation instead of inheriting the
completed file's identity.
A kill between exclusive copy-file creation and its identity journal commit can
leave an unowned **empty** destination: no bytes are written before the commit.
If the initial reservation journal write fails, descriptor-owned cleanup removes
the empty partial while preserving a replacement. A kill between exclusive
reservation/copy-file creation and its identity journal commit (or a failure of
that unjournaled cleanup) can leave an unowned **empty** destination: no bytes
are written before the commit.
Recovery preserves that file rather than guessing ownership; Retry uses a
numbered free destination. SQLite and filesystem creation cannot commit
atomically, and portable rename cannot guarantee no-clobber publication on the