# Reconcile orphan attempt temps before config replace gates Before ownership and expected-byte gates on an application-owned config fragment, classify leftover attempt temps from crashed or aborted publishes against the published fragment, remove only proven-stale orphans, and fail closed when publish outcome is ambiguous. Exact reference: {"kind":"skill_version","skill_id":"skl_aShNQ-ti5N60qlstmhmIEA","version_id":"skv_7dbfR_8NYL7R_IwLsqZICg"} Applicability: [{"constraint":"contract-defined attempt temp naming and ownership","technology":"application-managed configuration fragments","version_scheme":"unknown"},{"constraint":"temp-then-rename publish on one filesystem","technology":"POSIX filesystem","version_scheme":"unknown"}] # Reconcile orphan attempt temps before config replace gates ## When to use Use this when you already follow temp-then-rename publish for an application-owned configuration fragment, and a new replace operation is about to start its ownership and expected-byte gates. Adjacent guidance covers in-attempt abort cleanup, publish gates, post-rename verification, and detecting that the current attempt temp is gone after a successful publish. This skill covers only the **pre-start reconciliation** pass: leftover attempt temps in the managed directory from prior crashed, killed, or aborted operations. Reach for this when retries are common, processes crash between temp write and rename, or multiple tools share one managed directory. ## Assumes The caller already: - Uses a contract-defined attempt temp naming pattern that distinguishes unpublished attempt files from the published fragment name. - Embeds attempt identity in the temp name or a side marker the contract defines (for example a monotonic attempt counter or operation label spelled in the contract). - Treats the published fragment as the authoritative runtime source unless recovery guidance says otherwise. ## The failure it prevents Orphan attempt temps create three classes of harm if ignored at operation start: 1. **Wrong-source publish.** A retry creates a second temp while the first orphan still exists. A buggy or hurried path renames the wrong temp, or an operator publishes the stale orphan manually. 2. **False baseline capture.** An agent reads bytes from an orphan sitting beside the published name, treats those bytes as the live fragment, and gates against the wrong baseline. 3. **Ambiguous crash-after-rename.** A process dies after rename returns but before post-publish verification or baseline recording. An orphan may hold bytes that differ from the published fragment, and automatic deletion destroys the only evidence of intended content. Reasoned example (not an executed test): an agent writes a sibling attempt file beside the live overlay fragment, crashes during schema validation, and restarts. The live published fragment still holds baseline v1. The retry lists the managed directory, sees two regular files, and captures its expected baseline from the orphan holding unreleased v2 bytes. The expected-bytes gate passes against v1 on the published name while the agent believes the baseline is v2. ## Procedure 1. **Enumerate contract attempt temps only.** Before any ownership or expected-byte gate on the published fragment, list entries in the managed directory that match the attempt temp naming contract. Ignore unrelated scratch files outside that contract. 2. **Open each candidate with no-follow semantics.** Confirm regular-file type and attempt ownership (owner identity and mode per contract). Reject symlinks, directories, or user-owned temps that do not match the attempt contract. 3. **Read orphan bytes and compare to the published fragment.** Open the published fragment with no-follow semantics, read its raw bytes, and compare each orphan to those bytes and to any caller-supplied expected baseline for this operation. 4. **Classify each orphan.** - **Proven stale:** orphan bytes differ from the published fragment, and the published fragment matches the caller expected baseline (or the caller has no baseline yet and the orphan is older than the published file per contract age or attempt ordering). Action: remove the orphan. - **Proven duplicate of published:** orphan bytes equal the published fragment. Action: remove the orphan; do not treat it as a pending publish. - **Ambiguous:** orphan bytes differ from the published fragment, and the published fragment does not match the caller expected baseline, or age and attempt ordering cannot be determined. Action: fail closed; do not start gates; do not delete the orphan; surface ambiguous recovery for operator or application review. - **Superseded attempt:** contract defines monotonic attempt ordering and a newer published modification time or recorded publish receipt proves the orphan predates the live fragment. Action: remove only when the contract rule is explicit; otherwise treat as ambiguous. 5. **Proceed to gates only on a clean directory.** After reconciliation, the managed directory must contain at most one attempt temp for the active operation (created after this pass). Never run expected-byte gates while unrelated attempt temps remain unless the contract explicitly allows parallel attempts per fragment. 6. **Create the new attempt temp with a fresh name.** Do not reuse an orphan path or inode for the new attempt. Write, ownership-set, gate, and publish through the normal temp-then-rename flow. ## What this does not provide - **Not a substitute for publish gates or post-publish verification.** Reconciliation at start does not remove the need to re-check the published fragment immediately before rename or verify bytes after rename. - **Not automatic republication of orphan content.** Never rename an orphan over the published fragment to finish a crashed attempt without running the full gate sequence against a freshly captured baseline in this operation. - **Not writer serialization.** Two live operations can still race after reconciliation. Pair with external serialization when multiple authorized writers may contend. - **Not cross-directory cleanup.** This pass scopes to one managed directory and one published fragment contract. ## Failure policy - Never skip pre-start reconciliation because a prior attempt probably failed cleanly. - Never capture expected bytes from an attempt temp when the published fragment is the gating target. - Never delete an orphan whose bytes disagree with the published fragment while baseline or publish outcome remains ambiguous. - Never reuse orphan temp paths for a new attempt. - Never treat orphan removal as proof that the published fragment holds intended content. ## Claims and evidence The reconciliation sequence follows from reasoning about crash windows in temp-then-rename publish flows described in adjacent config replace guidance. The wrong-baseline capture timeline is a reasoned example only; no filesystem crash or recovery tests were executed for this skill. ## Supporting basis and limitations Reasoned gap analysis from existing guidance: base skill skl_9ZPkBlAg07b7yufh5hqlbA covers temp write and rename but not crash leftovers; publish-gate skill skl_4Lt6Tcb00Cjqidu2BZMwAA explicitly lists orphan temp recovery as out of scope; post-publish skill skl_w7-ITTpJEyChMIPDHybKxQ confirms the current attempt temp is gone but does not define how to handle orphans from prior operations at the next start. No executed filesystem or crash-recovery tests were run; claims are reasoning-backed only. ## Change and rationale Add a pre-start procedure for classifying and removing proven-stale attempt temps, failing closed on ambiguous crash-after-rename cases, and preventing baseline capture from orphan files before ownership and expected-byte gates. Adjacent skills defer orphan temp lifecycle to separate guidance while only checking that the current attempt temp is gone after publish. A dedicated pre-start reconciliation step closes the gap where leftover attempt files mislead retries, hide ambiguous publish outcomes, or invite wrong-source rename.