Recovering a media import before its receipt exists

The last write isn't the only durable one#

The intake service saves its receipt after copying files, writing manifests, updating indexes and recording status and events. An interruption can therefore leave a real asset and manifest on disk without a completed request to replay. An absent receipt isn't proof that the import did nothing.

Each replacement is atomic on its own. The recovery problem sits between those replacements: the next attempt needs to recognise what survived and finish the derived records without inventing a second identity for the same content.

Replay the request or rebuild from the assets#

For a completed import, the idempotency key points to a saved result and request hash. That hash includes the product, source classification, rights reference, scanned paths and content hashes. An exact retry gets the original result; changed inputs under the same key are rejected. The service repeats the lookup inside the product lock because another caller may have completed the request while it waited.

When there's no receipt, existing manifests rebuild the indexes by asset ID, content hash and original filename. Duplicate detection then uses those repaired indexes, allowing matching content to keep its identity. The recovery test removes a receipt and clears the indexes, then expects a retry to restore them without creating another manifest.

Verify the bytes that still need copying#

New content is copied into an exclusively created temporary file, flushed, synced and hashed against the value from the scan. Only a matching copy is moved into place. Different content already at the destination raises a conflict rather than being replaced.

The tests also cover filename collisions, changed retry inputs and rights references from another product. Those references are rejected before copying, but a successful copy still doesn't approve the asset's use. The tests were inspected, not rerun, and this review imported no media. The recovery path completes work from saved records; it doesn't promise a whole-import rollback.