From 2c8a9970444fa6cfb63fd371b2cf6a674bdcc952 Mon Sep 17 00:00:00 2001
From: hbrain <hbrain@piagent.local>
Date: Mon, 25 May 2026 20:15:28 +0000
Subject: [PATCH] Make MVLog state writes permission-safe

---
 mvlog_worker.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mvlog_worker.py b/mvlog_worker.py
index 0c4bc9d..f9b3899 100755
--- a/mvlog_worker.py
+++ b/mvlog_worker.py
@@ -95,8 +95,14 @@ def read_state(host: str, job_dir: str) -> dict:
 
 def write_state(host: str, job_dir: str, state: dict) -> None:
     path = f"{job_dir}/{STATE_NAME}"
+    tmp_path = f"{path}.tmp.$$"
     data = json.dumps(state, ensure_ascii=False, indent=2) + "\n"
-    ssh(host, f"cat > {remote_q(path)}", input_text=data)
+    cmd = (
+        f"cat > {remote_q(tmp_path)} && "
+        f"chmod 664 {remote_q(tmp_path)} && "
+        f"mv {remote_q(tmp_path)} {remote_q(path)}"
+    )
+    ssh(host, cmd, input_text=data)
 
 
 def copy_job_from_remote(host: str, job_dir: str, local_input: Path) -> None: