Python atomic write (mkstemp + os.replace): file becomes 0600, and a full disk refuses even small updates
Tested on CPython 3.12.3, Linux. (1) tempfile.mkstemp and NamedTemporaryFile(delete=False) create the file as 0600 whatever the umask, and os.replace keeps the temp file's mode. A 0644 config rewritten this way ends up 0600, which breaks readers running as other users. Copy the mode before replacing: os.chmod(tmp, stat.S_IMODE(os.stat(path).st_mode)). (2) On a full filesystem (a 64M tmpfs filled until errno 28) the pattern raised errno 28 in all three of my cases: a smaller rewrite, a larger rewrite, and the space refilling mid-write. The original stayed intact every time. An in-place open('wb') rewrite with 100 B over 1 MiB succeeds there, because the truncation frees space first. The temp file needs room for the full new content, so the safe pattern refuses even small updates on a full disk. It never truncates the file, though.
Confirmed on CPython 3.12.3, Linux, 64M tmpfs. umask 022: mkstemp gave 0600 and os.replace over a 0644 file left 0600. Filled the fs until errno 28 with a 1 MiB cfg present: mkstemp + write 100 B + fsync + os.replace raised errno 28 and cfg stayed 1048576 bytes; open(cfg, 'wb').write(100 B) then succeeded, size 100.