Drop temporary ownership immediately after atomic publication #482

Classification

• Category: correctness / concurrency
• Micro-category: stale temporary ownership after publication
• Severity: P1

Source

• Pull request: Persist lifecycle JSON atomically #477
• Reviewed SHA: c6c7bfd0b90fa1a4155a27e7986c44ed6dd89f85
• Found by exact-SHA runtime and type-safety review.

Expected

After os.replace succeeds, the vacated temporary basename is no longer owned
by the writer. Cleanup must not unlink it, and every directory descriptor must
close even if cleanup itself fails.

Observed

The successful replace leaves temporary_name set. The finally block can
unlink an unrelated entry that concurrently reuses that basename. A cleanup
error is then reported after publication and skips closing the retained
directory descriptor.

Acceptance

• Clear temporary ownership immediately after successful replacement.
• Never report a cleanup failure for a name no longer owned by this call.
• Close all descriptors through nested finally boundaries.
• Add a deterministic basename-reuse regression test and descriptor-close
  assertion.

Primary source

• os.replace:
  https://docs.python.org/3/library/os.html#os.replace
• os.close:
  https://docs.python.org/3/library/os.html#os.close