writeAtomic, everywhere a file lands

the .part-then-rename rule was applied at two upload routes yesterday and
by this morning the platform had a dozen other writes putting files in the
same folders — an OCR result beside its image, a TTS clip, a download
landing, a save from the editor — every one straight to the final name. a
guarantee that holds for two of fourteen paths is not a guarantee, and the
next person adding a fifteenth had nothing to copy.

so it is a function now, and every durable write goes through it: the file
browser, sendoff, task definitions, skill and tool files, bug reports,
scraped attachments, the chat provider config.

the failure it prevents is silent rather than loud. a truncated m4a decodes
fine, it is simply short — a commander transcribing recordings as they land
would produce a clean transcript of the first few seconds of a two-minute
memo and report success.

two things learned writing it. Bun.write creates the parent chain itself,
so the mkdir option i added was dead weight and several callers were doing
it twice. and Parameters<typeof Bun.write>[1] resolves to the first
overload only — BunFile — which rejects the string and Buffer every caller
actually passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/api/sendoff/router.ts

@@ -1,4 +1,4 @@
-import { mkdir, rename, rm } from 'node:fs/promises';
+import { mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { extname, join } from 'node:path';
 import { createRouter } from '../../create-router';
@@ -17,6 +17,7 @@ import {
   upsertSendoffDevice,
 } from 'officerdb';
 import { getNotifyServerUrl, notifyProducerHeaders } from '../notify/router';
+import { writeAtomic } from '@@/write-atomic';
 import { displayNameFor, folderNameFor, safeFilename, safeSegment, sendoffDirFor } from './paths';
 
 /*
@@ -152,19 +153,11 @@ sendoffRouter.post('/send', async (ctx) => {
   await mkdir(dir, { recursive: true });
 
   const written: { name: string; size: number }[] = [];
-  // Aside, then rename — the same reasoning as the file browser upload, and it matters more here
-  // because this is a folder things ARRIVE in unattended. Neither a recipient watching it nor the
-  // notification below may point at a name that is still being written.
+  // `writeAtomic` matters more here than anywhere: this is a folder things ARRIVE in unattended.
+  // Neither a recipient watching it nor the notification below may point at a name still being written.
   for (const file of files) {
     const path = freePath(dir, safeFilename(file.name));
-    const partPath = `${path}.part`;
-    try {
-      await Bun.write(partPath, await file.arrayBuffer());
-      await rename(partPath, path);
-    } catch (err) {
-      await rm(partPath, { force: true }).catch(() => {});
-      throw err;
-    }
+    await writeAtomic(path, await file.arrayBuffer());
     written.push({ name: path.split('/').pop() ?? file.name, size: file.size });
   }