Bun.write(filePath, file) streams to the name the file will end up with, so for
as long as an upload takes, that name exists holding a partial file and nothing
watching the folder can tell. The failure is silent rather than loud — a
truncated m4a decodes fine, it is just short — so a watcher transcribing voice
memos as they arrive would produce a clean transcript of the first few seconds
of a two-minute recording and report success.
Writing to <name>.part and renaming makes the final name either absent or
complete. Every consumer gets that for free: the phone's own uploadVerified, a
watcher, an agent reading the folder. The alternative was each of them inventing
"the size stopped changing", which cannot tell a finished upload from a stalled
one.
SendOff had the same shape and it matters more there, because that is a folder
things arrive in unattended — neither a recipient watching it nor the push
notification may name a file still being written.
.part rather than a dotfile, deliberately: a leftover should be VISIBLE, named
for what it was going to be, beside where it belongs. A failed write cleans up
after itself; only an interrupted process leaves a fragment, which is the case
worth being able to see. Nothing sweeps them — a job deleting files it did not
create is a worse trade than a fragment somebody can spot.
Server-side only. The phone uploads exactly as before and its verification read
happens after the response, by which time the rename has landed. No new build.
Verified: a watcher polling every millisecond through a 40 MB write never saw a
partial file under the final name, and a real 8 MB upload through the live route
left the file complete with no .part behind. 1422 pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
pastilhasandClaude Opus 5
54f9f24726