[Jacob-Met]

Preserve the last complete saved review when a replacement cannot be staged

Rerunning TestPilot into an existing output directory currently writes each final file in place. A real filesystem size limit can truncate the saved patch or HTML after earlier outputs have already changed, destroying the previous complete review. This change prepares all four output contents and stages complete files on the output filesystem before replacing any final path.

Preparation, final-path admission and staging errors propagate while preserving every existing final artifact. Observed directories, symlinks and other nonregular final targets are refused before publication. Successful writes keep the existing filenames, exact output bytes, native newline behavior and returned path mapping. Mode bits are copied to replacements; as the README explains, directory permissions govern replacement, so a read-only regular target can still be replaced when its directory permits it.

Final publication replaces the four files individually. A later replacement failure can leave a mixture of complete old and new files. This does not claim a four-file transaction, crash recovery or concurrent-writer coordination.

Closes #29.

Source scope and current composition

Only testpilot/loop.py::write_outputs, four standard-library imports, a focused new test file and narrow README documentation change. Every other loop AST node remains exact. Saved-test recheck, the current module-selector fix, raw-diff handling, generation/repair logic, HTML rendering, provider routing and all unrelated owner work are preserved.

Published head 9d060238f9eef2af716f147819ceed1971aa6b5a is based on actual current main f3b2135cad31852b599350564fe76dd160a6a522; tree ea3f7b4170f1515abb7188d31dc269623b9e0738 contains 1,063 leaves. All 24 contribution files and all 1,039 unowned base leaves/modes were checked against the composed Git tree before publication. Native execution materialized the complete maintained Python/test/eval/configuration selection, with its full canonical-tree pins retained; archived repository evidence and the separate web demo were not executed or relabeled as a full native checkout.

Actual receiving

• The author qualified 24 focused controls and 75 inherited controls, including real early/late EFBIG failures and exact successful output bytes.
• A separate root receiver accepted 14 case groups / 32 native child observations: real file-size failures at patch, JSON and HTML; JSON-preparation failure before creation or replacement; staged chmod failure; nonregular admission; cleanup; unchanged unrelated files; exact successful bytes, modes, path mappings and embedded downloads; and the honest last-replacement boundary.
• The first byte-success oracle used an existing mode0444 Markdown file. Its actual baseline EACCES and the candidate's directory-authorized replacement are preserved as a separate permission-boundary result. Only the four successful-write cases per variant were repeated with writable0644. The earlier preparation helper's Git-NUL framing error is also retained; it refused before writing any source file.
• Native composition with saved-test recheck main 63174afd8e63a0ea562cf188b7d971522f017a30 passed 352 tests and 18 subtests. The only subsequent existing-source change on current main is the module-selector condition; the final native composition passes its nine new tests while preserving the exact writer and all other previously received native source. All source hashes stayed unchanged during these runs.
• Actual runtime: existing Python3.12.14 / pytest9.1.1 / coverage7.16.2, isolated synthetic local inputs, no model/provider calls. These are Linux runs; no Windows execution is claimed. Exact published-head hosted checks remain the separate final integration gate.

Complete evidence and custody

The independent current-source packet includes the source manifests, receiver results, current native suite and documentation amendment. Its complete archive is 127,373 bytes / 449 verified safe regular members, SHA-256 55a48d8679fd3ed718e174d916d3c01cec0b9b7c5fafb6483daa0def0408a5b2. It retains both receiver revisions, failed observations, actual old/new files and every per-file digest.

The complete author archive is 189,674 bytes, SHA-256 3143f49b39059cb37d6e2001d8f96ba2ff369da65d06a4a542294a2d5f598dab; all 14 original author receipt payloads remain unchanged. Both archives are included in this Git tree. Separate native artifact-destination copying remains under the recorded capacity hold; no successful upload to that destination is claimed.

[Jacob-Met]

Integrated and post-merge verified. PR34 merged as 7f44c4f134f4d56d37dd14c7c2d2aaa3c8c8749e, tree ea3f7b4170f1515abb7188d31dc269623b9e0738, with parents current main f3b2135cad31852b599350564fe76dd160a6a522 and the exact accepted head 9d060238f9eef2af716f147819ceed1971aa6b5a. Issue29 is closed as completed.

The actual merge has all 1,063 leaves, preserving all 1,039 unowned base leaves and modes. All 24 contribution payloads / 481,866 bytes were fetched back from the published head and compared with their native originals; both complete archives match exactly. The actual merge uses that same received tree. A separate native correspondence check hashed all 86 current Python/test/eval/configuration source files against the actual merge tree; receipt 22,796 bytes, SHA-256 8c5131a0c108b99e74e6f94eb4fa0920eae74ab2279c819d6eecc32ebc53c1b9.

Both the exact-head CI run37800352011 and post-merge CI run37800754771 completed successfully with 361 tests and18 subtests passed. The post-merge native test step took74.86seconds. No model/provider operation or installed-runtime update was needed.

The merged independent receiving packet retains the 14 groups /32 real observations, original failures and corrected successful-write oracle, source pins, actual old/new files and the directory-permission/late-replacement limits. The root archive is127,373bytes /449 safe regular members, SHA-256 55a48d8679fd3ed718e174d916d3c01cec0b9b7c5fafb6483daa0def0408a5b2; the author archive is189,674bytes, SHA-256 3143f49b39059cb37d6e2001d8f96ba2ff369da65d06a4a542294a2d5f598dab.

After full public/private readback, exactly one newly created shared archive transport duplicate was retired; its private originals and merged Git copy remain intact. Public readback receipt SHA-256 7fdb4b58b1307bb963d60397eabf2b43b003cae0eb30e95e6f5861deb6ba2833; bounded cleanup receipt SHA-256 5803cc4426d6709f884388a640602e28d39cef8fe98d5376b63e6a58d4b87e53. Separate native artifact-destination copying remains under the existing capacity hold.