[vpetersson-bot]

What's wrong today

backup_helper.recover() extracts every tar member straight to its final
path. For the media store that means an asset which already exists on the
device is truncated and then refilled under its own name, and nothing
stops the viewer fetching that same file over /anthias_assets/<name>
while the write is in flight.

Django's FileResponse measures Content-Length from the file as it
stands when the response is built, then streams that same open fd to EOF.
Rewriting the inode underneath a live reader breaks the promise in both
directions:

restored copy	what uvicorn raises
larger than the old one	RuntimeError: Response content longer than Content-Length
smaller than the old one	RuntimeError: Response content shorter than Content-Length

The 500 is the visible half. The quiet half is that the viewer has already
been handed a frame spliced out of two different files.

The overrun is Sentry ANTHIAS-37 (transaction: /anthias_assets/{filename},
raised in uvicorn/protocols/http/httptools_impl.py:send off Django's
asgi.py:send_response, no Anthias frame in the traceback — which is why
it reads as framework noise).

Every other writer of the media store already stages to a sibling and
renames: processing.py (os.replace(staging, final_uri)),
celery_tasks.py (.part → os.replace), views.py (chunked upload →
os.replace), integrations/ingest.py (.part → os.replace). Restore
was the one path that did not.

What this changes

Media-store files are now extracted under .restore-<hex>.tmp beside
their destination and os.replaced into place, which the kernel observes
as a single inode swap. An in-flight response keeps reading the inode it
opened and still matches the length it declared, and no request can
observe a partial asset.

The staging name is dot-prefixed and .tmp-suffixed deliberately — all
three existing guards already cover that shape:

• views_files.anthias_assets 404s on a dot-prefixed path component and
  on a .tmp/.part suffix, so a staged file is never servable;
• _exclude_from_backup drops it from the next archive;
• the hourly cleanup() sweep collects it if the process dies between the
  extract and the rename (the explicit remove on the error path covers
  the rest).

Config and database members keep the plain tar.extract path on purpose.
On an upgraded device .screenly/screenly.db is a back-compat symlink
into .anthias/ (bin/migrate_legacy_paths.sh) and extraction is meant
to write through it — an os.replace there would replace the symlink
with a regular file and leave the real database untouched. The existing
WAL-clearing contract in recover() is unchanged.

Also corrects the before_send comment in settings.py that credited the
shorter rule with ANTHIAS-37. ANTHIAS-37 is the longer variant, so
that rule never matched it; and a genuine overrun is a bug in whatever
produced the response, not noise to drop — so no filter is added here, the
cause is fixed instead.

How I know it's right

New regression test test_recover_swaps_assets_atomically holds an open
fd on an existing asset across a recover() that lands a larger copy, and
asserts the reader still sees the old bytes at the old length, that the
inode changed, that the new bytes are on disk afterwards, and that no
staging file is left behind. It fails on master (the fd observes the
rewritten file) and passes here.

test_recover_clears_the_stale_wal_when_a_later_member_fails patched
TarFile.extract on an exact member name; it now matches the asset-dir
prefix, since that member arrives under its staging name. Its assertions
are untouched.

• uv run pytest -n auto -m "not integration" → 2563 passed, 3 skipped.
  One pre-existing failure under -n auto,
  test_viewer.py::TestWaitForWaylandSocket::test_probe_reports_not_ready_for_a_non_socket_path,
  reproduces identically on an unmodified tree and passes in isolation —
  unrelated to this change.
• uv run ruff check ., uv run ruff format --check ., uv run mypy .
  all clean.

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud