astrid-runtime/astrid · error

quarantined capsule authority bytes changed: {}

Error message

quarantined capsule authority bytes changed: {}

What it means

quarantine_legacy_authority_receipt moves a leftover legacy authority receipt into a quarantine directory, then re-reads the moved file and compares its bytes to what was read before the rename. If the quarantined copy differs from the original bytes, the library throws this error because the atomic preservation of the receipt could not be verified — the data being archived may be corrupted or was modified mid-operation.

Source

Thrown at crates/astrid-capsule-install/src/authority/leftover.rs:131

    let destination = unique_quarantine_path(&quarantine_root, file_name)?;
    fs::rename(path, &destination).with_context(|| {
        format!(
            "quarantine leftover capsule authority {} to {}",
            path.display(),
            destination.display()
        )
    })?;
    if let Some(parent) = path.parent() {
        sync_authority_directory(parent)?;
    }
    let preserved = fs::read(&destination).with_context(|| {
        format!(
            "read quarantined capsule authority {}",
            destination.display()
        )
    })?;
    if preserved != bytes {
        bail!(
            "quarantined capsule authority bytes changed: {}",
            destination.display()
        );
    }
    tracing::warn!(
        leftover = %path.display(),
        destination = %destination.display(),
        "quarantined unmatched leftover capsule authority receipt"
    );
    Ok(destination)
}

/// Unlink one leftover receipt after its durable ingest has been verified.
pub(crate) fn retire_unmatched_authority_receipt_file(
    path: &Path,
    expected_bytes: &[u8],
) -> anyhow::Result<()> {
    let metadata = fs::symlink_metadata(path).with_context(|| {

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-run the operation; transient concurrent modification is the most common cause and a retry on a quiet system usually succeeds
2. Stop any process that could touch the home directory (cloud sync, antivirus scans, another running instance) before retrying
3. Inspect the quarantined file at the reported destination and manually compare it with a backup; if intact, it is safe
4. Check filesystem health (fsck / mount type); move the home dir to a local, non-synced filesystem if corruption recurs

Example fix

// before: running migration with live sync daemon
$ astrid migrate  # -> quarantined capsule authority bytes changed: ~/.astrid/migrations/quarantine/receipt.json
// after
$ systemctl --user stop dropbox
$ astrid migrate  # succeeds

let bytes = std::fs::read(&path)?;
if !path.is_file() { anyhow::bail!("not a regular file: {}", path.display()); }
// ensure no other writer holds it open where possible (e.g. flock the file)

fn is_stable_regular_file(p: &Path) -> bool {
    std::fs::symlink_metadata(p).map(|m| m.is_file()).unwrap_or(false)
}

match quarantine_legacy_authority_receipt(&home, &path) {
    Ok(dest) => info!("quarantined to {}", dest.display()),
    Err(e) if e.to_string().contains("bytes changed") => {
        warn!("concurrent modification during quarantine; retrying once");
        // stop sync/AV writers, then retry
    },
    Err(e) => return Err(e),
}

When it happens

Trigger: Calling retire_one_leftover → quarantine_legacy_authority_receipt on a receipt whose content changes between the pre-rename fs::read and the post-rename read of the destination (destination in leftover.rs:124-135). This happens if another process writes to the file during the rename, the filesystem (e.g. network mount) corrupts or alters data on move, or an editor/sync daemon (Dropbox, antivirus quarantine) rewrites the file.

Common situations: Running capsule install/migration while a cloud-sync or antivirus service watches the migrations directory and rewrites files; a flaky NFS/FUSE mount where rename is not byte-stable; concurrent instances of the tool racing on the same home directory.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• leftover capsule authority receipt changed before retirement
• projected file changed while read: {}
• workspace capsule manifest changed while it was being read:
• capsule materialization target is redirected: {error}
• read capsule projection entry: {error}

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/559680dbee01da7d. Report an issue: GitHub.