Every writer used to stage into the same `.artifacts/.partial/<cacheKey>`.
That was safe only because the artifact lock held: two writers that both
believed they had it opened the same blob with O_APPEND and interleaved
their bytes into one file, while the resume probe read the other writer's
in-flight size. SHA verification caught the damage only after both had
burned the entire download.
#10986 restored the lock's precondition on CIFS but left the dependency in
place. Suffix the staging tree with a writer identity drawn once per
process run, so concurrent writers cannot corrupt each other whatever the
lock does. The lock stops being a correctness dependency and becomes a
pure efficiency optimisation: a lock failure now costs a duplicated
download, not a corrupted one.
Commit stays an atomic rename. The loser of a commit race reconciles onto
the winner's tree instead of surfacing a bare ENOTEMPTY for work that
actually succeeded, since the artifact is content-addressed and both trees
hold the same verified bytes.
Writer-unique staging means a crashed writer's tree is no longer
overwritten by its successor, so two things are added to keep it from
becoming a disk leak and a resume regression:
- A sweep reclaims trees whose contents have been untouched for 24h,
matching the window the startup reaper already uses for stray *.partial
files. It reads the newest mtime anywhere inside the tree, because
writing a blob never touches an ancestor, and refuses any name this
package did not write. A live download writes continuously, and the
downloader's stall watchdog aborts a silent one long before it could
look abandoned.
- Adoption lets a restarted process claim a dead predecessor's tree for
the same artifact and resume from its bytes, which a tens-of-gigabytes
repo depends on. The claim is an atomic rename, so racing adopters
cannot both win. It runs only under the artifact lock - which is
released exactly when the owning process dies - and only on a tree idle
for 5 minutes as a second line of defence for when the lock does not
exclude.
Assisted-by: Claude:claude-opus-4-8 [Claude Code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
