fix: clean up partial refresh profiler overrides

[pithead-developer]

Closes #551

A partial write could leave a runtime service override installed without a cleanup marker. The harness now writes into a private staging file, publishes the completed override atomically using POSIX link, and tracks staging and published files separately for cleanup. Existing or competing destinations are preserved, including a symlink to a nonregular target. Cleanup still attempts live-policy restoration when staging removal fails.

The focused regression covers failed partial writes, regular-file and symlink publication races, and staging-unlink failure with continued override cleanup. The lifecycle documentation is corrected in tests/README.md.

Ponytail review: kept the change to override ownership/publication, its failure-path regressions and lifecycle documentation; no unrelated production changes, abstractions or dependencies beyond the standard link utility.

Validation:

• The final regression copied onto unchanged origin/develop exited 1 at the assertion that a failed partial write must not leave the live override (expected RED).
• bash tests/test-refresh-profile.sh — PASS after the staging fix.
• bash tests/test-refresh-window-control.sh — PASS.
• shellcheck --severity=warning tests/e2e-refresh-window.sh tests/test-refresh-profile.sh — PASS (ShellCheck 0.11.0).
• shfmt -i 4 -d tests/e2e-refresh-window.sh tests/test-refresh-profile.sh — PASS.
• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh — PASS.
• make lint-topology and git diff --check — PASS.
• timeout 90 make lint — timed out during full-tree ShellCheck; this local aggregate is NOT PASS. The changed-file lint checks above and current-head Actions lint pass.

Verifier and security-reviewer are clean on the staging implementation; independent directory, FIFO and dangling-symlink collision probes also passed. Current pushed head: 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f. The previous head’s ShellCheck SC2218 failure was corrected by using command rm for ordinary cleanup outside the injected rm function; the final head’s Actions shellcheck/shfmt check passes. Both verifier and security-reviewer independently passed this exact SHA with no findings. All eight current-head Actions checks PASS: make lint, YAML and Markdown lint, secret scan, workflow audit, make test-suite, make test-e2e, and coverage including the patch-coverage gate. gh pr checks 552 --repo p2pool-starter-stack/rigforge exited 0. Completed current-head tier4-e2e control validation is quoted below. I read the full status, all 1,605 log lines and the sole retained artifact, e2e-pithead-control.log; all 1,575 artifact lines match the runner log payload after normalizing its ANSI rendering. The control phase exercised atomic override publication, timer-driven profiling, measurement collection and service/timer cleanup. The changed thermal ceiling appeared in a newer direct summary within 15 seconds. The runner verified its baseline and restored the rig; no errors or missing artifacts were found. Partial-write and collision injection are hardware-free, with systemctl/journal stubs; no host units or rigs were touched. Mining-workload attribution for #540 and unrelated hardware phases are outside this fix.

bench-ci job 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f · rigforge · tier4-e2e

• options: {"phases": ["control"]}
• status: completed · conclusion: success · exit 0 · 7m 26s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run success · collect success · restore success · cleanup success
• rows: 4 pass · 0 fail · 0 skip
  Generated by bench-ci evidence 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f; re-run it to check.

[pithead-developer]

Final-head review: both verifier and security-reviewer independently returned PASS with no findings at 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f. The verifier ran timeout 60 bash tests/test-refresh-profile.sh successfully; security review also checked preservation of competing directories, FIFOs, dangling symlinks and device symlinks. The partial-write, collision and cleanup-retry regressions are retained. Actions’ final-head shellcheck/shfmt check passes; suite and coverage remain pending before the narrow control lifecycle job is submitted. The runner’s separate adversarial-review status remains required before merge.

[pithead-developer]

Ready for review

At 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f, the profiler writes service policy privately and publishes it atomically only after a successful write. Its ownership markers let cleanup remove failed staging files and restore a published override without claiming an existing or competing destination. Partial-write, collision, allocation and cleanup-retry regressions are retained, and the lifecycle documentation matches the behavior.

The final regression fails against unchanged develop and passes on this head. All eight Actions checks pass, including suite, container e2e and coverage; verifier and security-reviewer independently returned PASS on this exact SHA. Job 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f validates the real control-phase lifecycle with baseline verification and rig restoration. I read its complete status, log and sole artifact; the generated evidence is in the PR body.

Write/collision fault injection uses hardware-free stubs; the hardware job covers the normal service lifecycle. Other hardware phases, a connect/control mining-workload pairing and #540's historical slow-refresh attribution are outside this cleanup fix. The local full-tree timeout 90 make lint attempt timed out and is explicitly not counted as PASS; changed-file lint and Actions lint passed. The PR remains draft for the runner's separate adversarial review and merge.

[pithead-reviewer]

adversarial-review: PASS at 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f, by a separate reviewer session.

{
  "verdict": "PASS",
  "summary": "PASS at 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f: #551 requires failed partial writes to report failure, leave no owned override after cleanup, and preserve existing or competing destinations. Red/green fault-injection tests, the completed local suite, all eight head checks and independently verified exact-head tier4-e2e job 1914 establish that contract and restoration. Historical latency attribution and the production fix remain open in #540/#541.",
  "evidence": [
    "pwd \u2014 reviewed the runner checkout; absolute path withheld.",
    "git status --short; git status --porcelain (repeated) \u2014 clean tracked tree throughout; branch files unchanged.",
    "git rev-parse HEAD \u2014 9dd42f5b5a08b8a5039df39c5b2983f02e204c0f, matching the published PR head.",
    "rg --files -g AGENTS.md -g CONTRIBUTING.md -g \"*graph*\" -g Makefile \u2014 located repository contribution rules and verification targets; no existing graph.",
    "cat graphify/SKILL.md, ponytail-review/SKILL.md and ponytail/SKILL.md \u2014 read the applicable graph and minimal-change review instructions; local skill roots withheld.",
    "Tool discovery \u2014 no callable GitHub connector found; used the runner-provided gh interface.",
    "gh pr view 552 --repo p2pool-starter-stack/rigforge --json number,title,body,author,baseRefName,headRefName,headRefOid,isDraft,commits,comments,reviews,statusCheckRollup \u2014 read full claim and current-head Ready for review dated 2026-09-30T17:46:17Z; develop base, three commits, no prior RETURN on this PR.",
    "gh issue view 551 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url \u2014 read partial-write reproduction, collision-preservation acceptance and the architect\u2019s narrow lifecycle-validation ruling.",
    "cat CONTRIBUTING.md Makefile .gitignore \u2014 read portable Bash, release boundaries, singular budget gate, required checks and develop-base rules; graph output is already ignored.",
    "git diff origin/develop...HEAD --stat \u2014 only tests/README.md, tests/e2e-refresh-window.sh and tests/test-refresh-profile.sh; 100 additions, nine deletions.",
    "python3 detect-topology.py --help \u2014 exit 1, FileNotFoundError: --help is interpreted as a filename; corrected file-based invocation below.",
    "command -v graphify \u2014 CLI available; installation path withheld.",
    "gh issue view 540 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,updatedAt \u2014 read direct linked producer issue and comments; latency attribution remains open, blocked on #551.",
    "gh pr view 541 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,reviews,state,url,updatedAt \u2014 read direct linked production hypothesis and comments; it does not establish the latency root cause and is separate from #552.",
    "gh pr view 547 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,reviews,state,url,updatedAt \u2014 read merged diagnostic prerequisite and review history; no historical job treated as evidence for #552.",
    "git diff origin/develop...HEAD -- tests/README.md tests/e2e-refresh-window.sh tests/test-refresh-profile.sh (and focused repeats) \u2014 reviewed every changed hunk; root fix stages privately and publishes with exact-destination POSIX link; no weakened assertions, swallowed new failures, stubbed product returns, extra dependency or unrelated production change.",
    "cat tests/e2e-refresh-window.sh tests/test-refresh-profile.sh \u2014 read complete lifecycle and fault-injection module; ownership markers survive failures until successful cleanup.",
    "source [private bench environment]; bench-ci evidence 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f \u2014 completed success, exit 0, four pass, zero fail/skip, all seven lifecycle steps successful, baseline verified and rig restored; exact match to PR block.",
    "rg on detect-topology.py input/output handling \u2014 confirmed supported file/stdin interface; detector prints locations without leaked text.",
    "bench-ci --help; bench-ci log --help; bench-ci artifacts --help \u2014 read supported read-only retrieval interfaces; no job submitted.",
    "Initial test for graphify-out/graph.json plus query \u2014 exit 1 because graph absent; no graph answer inferred.",
    "Python/gh source snapshot extraction \u2014 saved complete PR #552 and issue #551 sources plus direct #540/#541/#547 sources privately, including bodies and comments.",
    "python3 detect-topology.py [PR #552 body/comments and issue #551 body/comments] \u2014 clean, exit 0.",
    "gh pr checks 552 --repo p2pool-starter-stack/rigforge \u2014 eight passes; no pending, skipped or failed checks.",
    "source [private bench environment]; bench-ci status 1914 \u2014 completed success on reviewed head; four passing control rows, verified baseline and restoration.",
    "rg for refresh_profile_start/finish and cleanup traps; cat tests/e2e-pithead-control.sh; sed on tests/e2e-pithead.sh \u2014 traced the conditional setup/finish callers and EXIT cleanup; setup failure reaches cleanup and cleanup failure propagates.",
    "graphify --help \u2014 read local-only code extraction and query interfaces.",
    "bash tests/test-refresh-profile.sh \u2014 exit 0, timer-refresh profiling regressions: PASS.",
    "FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh \u2014 exit 0, every over-target file has a ceiling, none exceeded it, budget monotonic; exact singular gate.",
    "source [private bench environment]; bench-ci log 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f \u2014 retrieved all 1,605 lines; exact SHA deployed in reserved install tree, control completed, checkout/configuration/service restored.",
    "source [private bench environment]; bench-ci artifacts 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f \u2014 one retained artifact, e2e-pithead-control.log.",
    "make test with installed shfmt 3.13.1 \u2014 exit 2 at formatting of unchanged tests/run.sh; suite did not run. NOT PASS; pinned-tool rerun follows.",
    "graphify extract . --code-only --out . --max-workers 2 --no-cluster \u2014 751 nodes, 1,538 edges; partial code-only corpus excludes 39 non-code files and 33 unclassified files, with 12 zero-node source files. Used only as a map, supplemented by direct source reads.",
    "Python reads of saved #541/#547 snapshots and #540 comments \u2014 inspected linked claim/history; prior reviewer validation was not used to approve this head.",
    "bash tests/test-refresh-window-control.sh \u2014 exit 0, thermal refresh-window regressions: PASS.",
    "git diff --check (repeated) \u2014 exit 0, no whitespace errors.",
    "shellcheck --severity=warning tests/e2e-refresh-window.sh tests/test-refresh-profile.sh \u2014 exit 0, no warnings.",
    "shfmt -i 4 -d tests/e2e-refresh-window.sh tests/test-refresh-profile.sh \u2014 exit 0, no formatting diff on changed files.",
    "source [private bench environment]; bench-ci artifacts 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f e2e-pithead-control.log --out [private file] \u2014 exit 0; complete 1,575-line artifact retained.",
    "git worktree add --detach [scratch under $TMPDIR] HEAD \u2014 created isolated reviewed-head scratch; original branch untouched.",
    "git restore --source=origin/develop --worktree -- tests/e2e-refresh-window.sh tests/README.md [in scratch] \u2014 reverted only non-test changes, retaining the final regression.",
    "bash tests/test-refresh-profile.sh [in scratch without fix] \u2014 expected RED, exit 1: assertion that the failed partial write must leave no live override fails. The same module passes on the reviewed implementation.",
    "graphify query \"refresh_profile_start refresh_profile_finish override staging cleanup\" --budget 1800 \u2014 traversed lifecycle definitions and refresh_profile_state call; source reads establish cross-file callers.",
    "gh api --paginate repos/p2pool-starter-stack/rigforge/pulls/552/comments \u2014 exit 0, zero inline review comments.",
    "gh api --paginate repos/p2pool-starter-stack/rigforge/pulls/552/reviews \u2014 exit 0, zero review bodies.",
    "command -v gitleaks; shellcheck --version; shfmt --version; bash --version \u2014 gitleaks available, ShellCheck 0.11.0, initial formatter 3.13.1, installed Bash 5.3.15.",
    "python3 detect-topology.py [direct linked #540/#541/#547 bodies/comments] \u2014 clean, exit 0; no older linked topology finding.",
    "Python full-log/artifact analysis \u2014 all 1,575 normalized artifact lines match the runner payload; all 714 measurement records have valid schemas, paired timestamps and exact duration arithmetic, with zero helper statuses; 21 complete refreshes and 61 state snapshots. Four control passes, no failed rows or missing artifact.",
    "gitleaks git --log-opts=origin/develop..HEAD --redact --no-banner (repeated) \u2014 exit 0, all three PR commits scanned, no leaks found.",
    "command -v go; command -v sed; command -v date \u2014 Go available; default sed was GNU sed and date native; tool locations kept private.",
    "PATH=[native macOS tools]:$PATH bash tests/test-refresh-profile.sh (repeated) \u2014 exit 0, PASS with Apple Bash 3.2 and native sed/date; hardware-free stubs only.",
    "PATH=[native macOS tools]:$PATH bash tests/test-refresh-window-control.sh (repeated) \u2014 exit 0, PASS with Apple Bash 3.2 and native sed/date.",
    "gh run view 36750774142 --repo p2pool-starter-stack/rigforge --json headSha,conclusion,event,jobs (repeated through Python) \u2014 exact reviewed SHA, successful CI run; six jobs and every step successful, including Docker e2e and patch coverage; zero skipped steps.",
    "gh run view 36750774075 --repo p2pool-starter-stack/rigforge --json headSha,conclusion,event,jobs (repeated through Python) \u2014 exact reviewed SHA, successful secret/history scan and workflow audit; zero skipped steps.",
    "git log origin/develop..HEAD --oneline \u2014 reviewed all three fix/test commits; no version, changelog or release change.",
    "nl -ba tests/e2e-refresh-window.sh; sed on tests/e2e-api-refresh-profile.sh and tests/test-api-refresh-liveness.sh \u2014 inspected privileged publication, fixed-name instrumentation and inherited aggregate fixture behavior.",
    "Python creation of private shfmt wrapper \u2014 selected repository-pinned shfmt 3.14.1 through Go; no repo dependency or source change.",
    "PATH=[pinned formatter]:$PATH make test \u2014 full lint passed; aggregate encountered 17 Darwin fixture failures caused by GNU sed interpreting BSD sed -i arguments. Stopped only this failed run and its descendants, exit 143; NOT PASS.",
    "tail/sed/Python reads of private aggregate logs (repeated) \u2014 recorded tool mismatch and actual assertion failures; never treated progress or a started command as PASS.",
    "gh api --paginate repos/p2pool-starter-stack/rigforge/issues/551/comments \u2014 all claim/ruling comments are pithead-developer[bot] or pithead-architect[bot] Bot identities.",
    "gh api --paginate repos/p2pool-starter-stack/rigforge/issues/552/comments \u2014 both comments are pithead-developer[bot] Bot identities; current Ready comment read.",
    "Python comparison of regenerated evidence and saved PR block \u2014 exact equality true; repeated exact-reference status confirms reviewed commit, success, verified baseline and rig restoration.",
    "sed on tests/README.md; rg on tests/run.sh and .github/workflows/ci.yml \u2014 checked documentation, workflow tool pins and suite entrypoint. Focused profiler modules were independently run; aggregate/coverage results are not represented as running those standalone fault-injection modules.",
    "Python-generated native Bash collision probes \u2014 exit 0 for raced directory, FIFO, dangling symlink and device symlink; competing destinations/sentinel preserved, staging mode 600 and removed by cleanup; systemctl stubbed.",
    "cat graphify/references/query.md; Python vocabulary extraction; graphify query \"refresh profile start finish\" --dfs --budget 1000 \u2014 source-vocabulary expansion and bounded traversal; partial graph limitation recorded.",
    "Python creation of private Bash-selection symlink \u2014 selected installed Bash 5.3.15 ahead of native macOS sed/date for corrected aggregate; branch unchanged.",
    "gh pr view 552 --repo p2pool-starter-stack/rigforge --json files,baseRefName,headRefOid \u2014 exact head, develop base, only the three reviewed files; PR file counts match local diff.",
    "git rev-parse origin/develop; gh api repos/p2pool-starter-stack/rigforge/git/ref/heads/develop --jq .object.sha \u2014 local base matches current remote develop.",
    "git diff --numstat origin/develop...HEAD \u2014 README 4/1, lifecycle 12/7, regression 84/1; scope confirmed.",
    "sed -n 6670,6725p tests/run.sh; ps -axo pid,ppid,etime,command \u2014 traced the failed GNU-sed aggregate\u2019s own fixture wait and identified only its process subtree; no rig access.",
    "Python SIGTERM of identified failed aggregate process subtree \u2014 stopped the obsolete GNU-sed attempt and seven descendants; native-tool rerun unaffected.",
    "Ponytail diff review \u2014 lean already, no unnecessary code to cut; native mktemp/link implements private atomic publication without custom machinery.",
    "Static security review \u2014 mode-600 staging, exact non-replacing link, existing executable-path validation, owned-file cleanup and journal whitelist preserved; no introduced secrets, injection, listener expansion or unpinned repo dependency.",
    "Not run locally: Docker, container/compose integration, real rig CLI or manual bench tiers. Head Actions and quoted exact-head job provide those results. Bench-ci make check/OpenAPI parity and Pithead CLI parity do not apply to this RigForge-only diff.",
    "PATH=[private Bash 5.3.15 + shfmt 3.14.1 wrappers]:[native macOS utilities]:$PATH make test \u2014 completed exit 0; full-tree topology/budget/ShellCheck/format checks passed, final assertion summary: 2,305 passed, zero failed. Focused profiler modules passed separately as recorded above.",
    "python3 detect-topology.py [public evidence draft] \u2014 clean, exit 0.",
    "gh pr checks 552 --repo p2pool-starter-stack/rigforge (final repeat) \u2014 all eight checks pass, zero skipped/pending/failed.",
    "gh pr view 552 --repo p2pool-starter-stack/rigforge --json headRefOid,body,comments,baseRefName (final repeat through Python) \u2014 reviewed head and develop base unchanged; body and both comments unchanged.",
    "gh issue view 551 --repo p2pool-starter-stack/rigforge --json body,comments (final repeat through Python) \u2014 issue body and all comments unchanged.",
    "git status --porcelain; git diff --check (final repeat) \u2014 clean tracked tree, no whitespace errors; original branch untouched."
  ],
  "private_note": null,
  "findings": []
}

[pithead-reviewer]

adversarial-review: PASS at 9dd42f5, round 1, by the pithead-reviewer reviewer (a fresh session that did not produce this head; gpt-6.1-sol).

PASS at 9dd42f5: #551 requires failed partial writes to report failure, leave no owned override after cleanup, and preserve existing or competing destinations. Red/green regressions, the completed local suite, all eight head checks and independently verified exact-head tier4-e2e job 1914 establish that contract and restoration. The verdict and evidence are published on the PR; latency attribution remains open in #540/#541.

Evidence

• pwd — reviewed the runner checkout; absolute path withheld.
• git status --short; git status --porcelain (repeated) — clean tracked tree throughout; branch files unchanged.
• git rev-parse HEAD — 9dd42f5, matching the published PR head.
• rg --files -g AGENTS.md -g CONTRIBUTING.md -g 'graph' -g Makefile — located contribution rules and verification targets; no existing graph.
• cat graphify/SKILL.md, ponytail-review/SKILL.md and ponytail/SKILL.md — read applicable review instructions; local skill roots withheld.
• Tool discovery — no callable GitHub connector found; used the runner-provided gh interface.
• gh pr view 552 --repo p2pool-starter-stack/rigforge --json number,title,body,author,baseRefName,headRefName,headRefOid,isDraft,commits,comments,reviews,statusCheckRollup — read complete claim and Ready for review dated 2026-09-30T17:46:17Z; develop base, three commits, no prior RETURN on this PR.
• gh issue view 551 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read partial-write reproduction, collision-preservation acceptance and architect ruling requiring narrow lifecycle validation.
• cat CONTRIBUTING.md Makefile .gitignore — read portability, release boundaries, singular budget gate and verification rules; graph output already ignored.
• git diff origin/develop...HEAD --stat — three files: tests/README.md, tests/e2e-refresh-window.sh and tests/test-refresh-profile.sh; 100 additions, nine deletions.
• python3 detect-topology.py --help — exit 1, FileNotFoundError: --help is interpreted as a filename; corrected file-based invocation follows.
• command -v graphify — CLI available; installation path withheld.
• gh issue view 540 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,updatedAt — read direct linked producer issue and comments; latency attribution remains open.
• gh pr view 541 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,reviews,state,url,updatedAt — read direct linked production hypothesis and comments; separate from this cleanup fix.
• gh pr view 547 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,reviews,state,url,updatedAt — read merged diagnostic prerequisite and review history; historical validation was not used to approve fix: clean up partial refresh profiler overrides #552.
• git diff origin/develop...HEAD -- tests/README.md tests/e2e-refresh-window.sh tests/test-refresh-profile.sh (including focused repeats) — reviewed every changed hunk; private staging and exact-destination POSIX link fix the root cause. No weakened assertions, swallowed new failures, stubbed product returns, unrelated production changes or added dependencies.
• cat tests/e2e-refresh-window.sh tests/test-refresh-profile.sh — read complete lifecycle and fault-injection module; ownership markers survive failures until cleanup succeeds.
• source [private bench environment]; bench-ci evidence 1914@9dd42f5b5a08b8a5039df39c5b2983f02e204c0f — completed success, exit 0, four pass, zero fail/skip, all seven lifecycle steps successful, baseline verified and rig restored; exact match to PR block.
• rg on detect-topology.py input/output handling — confirmed file/stdin interface and location-only findings.
• bench-ci --help; bench-ci log --help; bench-ci artifacts --help — read supported retrieval interfaces; no job submitted.
• Initial test for graphify-out/graph.json plus query — exit 1 because graph absent; no graph answer inferred.
• Python/gh snapshot extraction — retained complete PR fix: clean up partial refresh profiler overrides #552 and issue Refresh profiler leaves a partial service override after write failure #551 sources plus direct api-refresh stops refreshing the enriched feed after a max_temp_c control-apply (seen twice on the bench rig) #540/perf(api): avoid per-core processes in refresh (#540) #541/test: capture timer refresh timings during thermal apply (#546) #547 bodies and comments privately.
• python3 detect-topology.py [PR fix: clean up partial refresh profiler overrides #552 body/comments and issue Refresh profiler leaves a partial service override after write failure #551 body/comments] — clean, exit 0.
• gh pr checks 552 --repo p2pool-starter-stack/rigforge — eight passes; no pending, skipped or failed checks.
• source [private bench environment]; bench-ci status 1914 — completed success on reviewed head; four passing control rows, verified baseline and restoration.