Publish one AI artifact without confusing visibility and durability

Start with one controlled artifact, not an arbitrary output path

A fictional assistant produces an ordinary two-line maintenance note A-A. Its consumer needs the exact checked revision, rather than a file that is still being written or an older artifact overwritten under a familiar name. The worksheet below is PROPOSED_UNRUN: no candidate file, descriptor, rename, synchronization, crash or storage experiment occurred.

Select one local Linux filesystem and one trusted parent directory. Both distinct names are application-selected relative single components beneath the same retained parent reference. The completed regular staging file has a retained descriptor referring to its exact checked bytes. Creation, descriptor acquisition, type checks and intended ownership/permissions are earlier reviewed prerequisites, not implemented here.

Require exclusive control over the relevant bytes and namespace: no other writer through another descriptor or hard link, no staging-name substitution, and no directory or mount manipulation. Keep staging inaccessible to consumers through the application’s reader policy. A filename convention alone supplies none of these properties.

Current release authority also needs a separately supported coordination boundary. If revocation can race publication without a defined decision, hold the artifact. Filesystem naming cannot authenticate a user, approve a model proposal or supply that coordination.

Choose a no-replace name transition explicitly

The rename manual opened for this guide identifies Linux man-pages 6.19. It documents Linux-specific renameat2 and RENAME_NOREPLACE, which refuses an existing destination instead of overwriting it. Underlying filesystem support is required; the documented collision error is EEXIST, while unsupported flags can produce EINVAL.

For this proposed profile, select that flag alone with both relative names anchored to the same parent reference. Absolute names would bypass the directory-reference interpretation. Do not replace refusal with ordinary overwrite, delete the destination to make room, or use a separate existence check as the protection.

The useful transition names an already completed immutable file; consumers must not depend on the producer finishing writes afterward. The documentation revision establishes no installed kernel, library or filesystem capability. Unknown support means hold, with no weaker fallback.

Keep file synchronization and directory synchronization distinct

The fsync manual, also man-pages 6.19, describes file-data and metadata synchronization that waits for the device’s completion report. File synchronization does not necessarily persist the containing directory entry; that requires an explicit directory synchronization.

Our proposed order is: finish and check A-A; freeze its associations and authorize release; obtain the file-sync acknowledgement; perform the supported no-replace name transition; then obtain the parent-directory-sync acknowledgement. A failed preparatory gate prevents the proposed transition. No worker should continue writing the published inode.

Atomic name visibility belongs to the supported rename transition, before the later directory acknowledgement; it does not combine preparation, authorization and synchronization into one transaction. If that later step fails, another authorized reader may already have opened the artifact. Record the observed visibility separately from uncertain crash persistence. Do not describe the outcome as never published, automatically rolled back or safely removable without reconciliation.

Use a disposition record that preserves uncertainty

Invent publication record P-A with artifact revision A-A, the checked-byte association, release decision reference and separate preparation, name-transition and parent-sync dispositions. These are worksheet labels, not a database schema or atomic implementation. Record supported acknowledgements rather than replacing them with one green success flag.

If a call result is unavailable, keep that step unknown and stop automatic replay. Reconciliation must establish the exact revision and namespace state through a separately authorized supported procedure. A matching digest alone cannot settle ownership, approval or whether a prior attempt became visible. Do not publish a second revision merely to hide the uncertainty.

A documented error needs its specific context; do not turn every negative result into a universal no-change assertion. This profile excludes NFS and other network filesystems, cross-filesystem moves, directory bundles and multi-file transactions. The rename manual specifically warns about failure ambiguity on NFS. Existing open descriptors are not recalled by renaming, so readers remain a separate authority and lifetime boundary.

Walk eight inert publication cards

State what this worksheet cannot prove

Synchronization can report write-back or space errors after earlier writes appeared successful. Neither acknowledgement is a universal physical-hardware guarantee, and no live storage stack was inspected. Directory persistence is not an authorization transaction or proof that several related files committed together.

No candidate syscall, file, descriptor, kernel, crash fixture, runtime, API or model was exercised. Future implementation needs independent review and controlled platform-specific verification. Boundary is prelaunch; its planned request checks do not provide this artifact publisher. The synthetic policy evidence covers different behavior. Useful publication, durable-storage evidence, authorized delivery and trustworthy model content remain separate claims.