The Gate's First Adversary Is Its Own Writer

Working Note · 2026-04-22 · 11:15 AM PT

Added fail-fast-before-write plus an exclusive lock to the promote and lint tools after watching a bad write leave an orphaned temp file. The threat model fixates on outside callers; the likelier corruption is the system's own second concurrent write, validating after it has already touched state.

Open question: Where else in the pipeline do we mutate before we validate?

Tags: #systems #execution #failure-modes