fix(resources): publish downloaded resources atomically

[sdornan]

Description

Splits the atomic-write half out of #4160 so it can be reviewed and land on its own. None of that PR's locked_fields provenance work is included here: no migration, no model, endpoint, or scan-handler changes. #4160 stays open for that half.

write_file_streamed opened the destination file directly, so an interrupted transfer truncated the target in place. A truncated file is worse than a missing one: it still satisfies the *_exists checks, so every later scan skips it and never refetches. The existing error paths cleaned it up, but only when the process survived to run them, which a SIGKILL or host reboot does not.

write_file_streamed is now an async context manager that writes to a temp file in the destination directory and renames it over the target once the caller's block completes, reusing the _atomic_write helper that uploads already use. The handle closes before the rename, so the target never sees a partial flush.

The _discard_partial_file calls that followed a streamed write are gone. There is no longer a partial file to remove, and the target now holds either nothing or the previous good copy, which those calls would delete. Refreshing a cover no longer costs the existing one when the transfer dies. _discard_partial_file itself stays, since the non-streamed paths (resize, small cover) still use it.

The second commit fixes cleanup on cancel: _atomic_write cleaned up in except Exception, which does not catch CancelledError, so stopping a scan mid-download stranded a .romm_tmp_* file per cancelled transfer. It now catches BaseException, which also covers uploads.

On tests: the two disk-full tests patched write_file_streamed itself, so they were asserting against the non-atomicity this removes. They now fail the write from the response stream and exercise the real path. Added coverage for an interrupted transfer leaving the previous cover intact, and for a cancelled transfer leaving no temp file behind.

AI assistance disclosure: written with Claude Code. The first commit is cherry-picked unchanged from #4160; the second commit and its test were lifted by hand from that PR's follow-up. I reviewed the result and ran the checks listed below.

Checklist
^{Please check all that apply.}

• I've tested the changes locally
• I've updated relevant comments
• I've assigned reviewers for this PR
• I've added unit tests that cover the changes

Verification: full backend suite against MariaDB, 2821 passed. The one failure in my run is pre-existing and unrelated (test_extract_chd_hash_permission_error fails on master too, because my local run is as root and chmod does not deny root). Merges cleanly into master at 7f57646, with the filesystem suite green on the merged tree (333 passed). black, isort, and ruff clean on the changed files.

[greptile-apps]

Greptile Summary

The PR makes streamed resource downloads atomic by writing into same-directory temporary files and publishing them only after successful completion. It also cleans temporary files when writes are cancelled and updates resource-download tests for interrupted, disk-full, and cancellation scenarios.

• Converts write_file_streamed into an async context manager backed by _atomic_write.
• Preserves existing resources when replacement downloads fail.
• Extends temporary-file cleanup to cancellation and other BaseException paths.
• Updates all resource callers and adds atomicity and cleanup coverage.

Confidence Score: 5/5

The PR appears safe to merge, with atomic publication and cancellation cleanup consistently applied to all repository callers.

Streamed writes close their temporary handle before same-directory replacement, failures preserve any existing target, cancellation removes the temporary file and propagates, and all known callers use the new context-manager contract.

Important Files Changed

Filename	Overview
backend/handler/filesystem/base_handler.py	Implements atomic streamed writes and broadens rollback cleanup to include cancellation while re-raising the original control-flow exception.
backend/handler/filesystem/resources_handler.py	Adopts the async-context-manager API at all streamed resource-download sites and removes cleanup that would incorrectly delete an existing good target.
backend/tests/handler/filesystem/test_base_handler.py	Updates the streamed-write test to use the new context-manager contract.
backend/tests/handler/filesystem/test_resources_handler.py	Exercises disk-full, interrupted-refresh, and cancellation behavior through the real atomic streaming path.

_{Reviews (1): Last reviewed commit: "fix(resources): clean up the temp file w..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This pull request updates backend filesystem resource downloads to publish streamed writes atomically, preventing interrupted transfers from truncating existing resources in place. It also improves temp-file cleanup on cancellation, and updates the filesystem handler tests to cover the new behavior.

Changes:

• Convert write_file_streamed to an async context manager that writes via _atomic_write (temp file then os.replace).
• Update resource download call sites to use the new context manager API and remove post-failure partial-file deletion that is no longer correct.
• Expand _atomic_write cleanup to cover cancellations, and adjust tests to exercise real streamed failure paths (disk full, dropped connection, cancellation).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
backend/handler/filesystem/base_handler.py	Makes streamed writes atomic and ensures temp files are cleaned up on cancellation.
backend/handler/filesystem/resources_handler.py	Switches resource downloads to the new streamed atomic writer and removes partial-file cleanup that would delete good existing files.
backend/tests/handler/filesystem/test_base_handler.py	Updates tests to use the new write_file_streamed async context manager API.
backend/tests/handler/filesystem/test_resources_handler.py	Adjusts failure-mode tests to exercise atomic streamed writes and adds coverage for cancellation and refresh safety.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.