Do not unlink a reused atomic JSON temporary name #485

Classification

• Category: correctness / concurrency
• Micro-category: temporary-name reuse during inode validation
• Severity: P1

Source

• Pull request: Persist lifecycle JSON atomically #477
• Reviewed SHA: 15fe4fa4e48179913d9acb2ef4754ffe02d9072f
• Found by exact-SHA bottleneck/adversarial review while verifying Keep atomic JSON cleanup anchored after temporary validation failure #483.

Expected

Cleanup may unlink a temporary basename only while the directory entry still
identifies the inode opened by this writer.

Observed

If the temporary entry is removed and an unrelated file reuses its basename
before inode validation, validation raises but the caller retains the basename.
The finally block then unlinks the unrelated replacement.

Acceptance

• Record the opened temporary inode identity.
• Treat missing or mismatched validation entries as lost ownership.
• Before failure cleanup, verify the current entry still matches the opened
  identity.
• Preserve an unrelated same-name replacement in a deterministic regression.

Primary sources

• os.fstat and descriptor identity:
  https://docs.python.org/3/library/os.html#os.fstat
• Descriptor-relative os.stat:
  https://docs.python.org/3/library/os.html#os.stat
• Descriptor-relative os.unlink:
  https://docs.python.org/3/library/os.html#os.unlink