write_target TOCTOU between check and write (documented) #151

Finding (as written in the restart doc, ChatGPT batch 3): the write_target TOCTOU (time-of-check to time-of-use) is documented but not fixed.

Suggested fix: create the target atomically (exclusive create or write to a temporary file in the same directory followed by an atomic rename after the final check), or keep the documented limit and add a test that states it. Decide with the owner before changing the contract.

Source: ChatGPT audit batch 3 (core), 2026-11-04; restart doc "Batch 3 FILE items".