security: rustdesk出库+ignore；nginx静态location补齐安全头(修add_header继承丢失)；tasks.py原子写；backup.sh可选异地；拍板清单落盘

PLANNING/tasks.py

@@ -21,8 +21,10 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import re
 import sys
+import tempfile
 from datetime import date
 from pathlib import Path
 
@@ -56,9 +58,19 @@ def load_state() -> dict:
 
 
 def save_state(state: dict) -> None:
-    STATE.write_text(
-        json.dumps(state, ensure_ascii=False, indent=2) + "\n", encoding="utf-8"
-    )
+    # 原子写：先落同目录临时文件再 os.replace，避免并发写或中断产生半截 state.json
+    payload = json.dumps(state, ensure_ascii=False, indent=2) + "\n"
+    fd, tmp = tempfile.mkstemp(dir=str(STATE.parent), prefix=".state-", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(payload)
+        os.replace(tmp, STATE)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def effective_status(task: dict, state: dict) -> str: