Keep atomic JSON cleanup anchored after temporary validation failure #483

Classification

• Category: correctness / filesystem safety
• Micro-category: descriptor-relative cleanup after validation failure
• Severity: P1

Source

• Pull request: Persist lifecycle JSON atomically #477
• Reviewed SHA: c6c7bfd0b90fa1a4155a27e7986c44ed6dd89f85
• Found by exact-SHA adversarial review.

Expected

Every temporary file created for atomic JSON publication is cleaned through the
directory capability that owns it. A mutable absolute parent path must never be
used after validation fails.

Observed

If temporary-entry validation raises before temporary_name is assigned, the
fallback calls Path.unlink() through the mutable absolute parent. Parent
retargeting can therefore delete an outside file while leaving the actual
descriptor-created temporary entry behind.

Acceptance

• Retain an anchored cleanup directory descriptor and basename as soon as the
  temporary file is created.
• Reject a temporary file whose parent capability is not the retained
  destination directory.
• On rejection, remove only the owned temporary entry and close every
  descriptor.
• Add a deterministic cross-directory/retarget regression test.

Primary source

• Python directory-descriptor paths:
  https://docs.python.org/3/library/os.html#paths-relative-to-directory-descriptors
• os.unlink:
  https://docs.python.org/3/library/os.html#os.unlink