The file backend streamed each object straight into its final key. An
upload cut off mid-stream left a truncated object at the blob's key, and
the next backup's Stat found it and recorded it as a complete blob, so
the snapshot reported success but was unrestorable.
Writes now go to a temp file in the destination directory, are fsynced,
then renamed onto the key, which appears only once the whole object is
durably written. Temp files carry a ".partial" suffix and are skipped by
List and ListStream, so a leftover from an interrupted write is never
listed or trusted as a blob and is otherwise harmless. S3 PutObject is
already atomic, so this only concerns the file backend.
model: claude-opus-4-8
