Windows Atomic File Publication
Headless document saving prepares and flushes an exclusive staging file in the destination directory before publishing its complete bytes through atomic replacement
On Windows, transient ERROR_ACCESS_DENIED, ERROR_SHARING_VIOLATION and ERROR_LOCK_VIOLATION failures permit at most eight MoveFileEx attempts with MOVEFILE_REPLACE_EXISTING and MOVEFILE_WRITE_THROUGH
Waits between attempts are 1, 2, 4, 8, 16, 16 and 16 milliseconds, totalling at most 63 milliseconds of requested waits; operating-system scheduling and syscall duration determine the actual elapsed time
Cancellation is observed before each attempt and before and after each wait; a completed successful atomic replacement is the publication boundary
Permanent locking or access restrictions preserve the original destination and report the last captured Windows error; other operating-system errors fail immediately
Failed document saves clean up their owned staging files; publication does not delete an existing destination and does not fall back to a partial copy
The same private path publishes ordinary saves, signed PDFs and standalone document timestamps; Linux continues to use its fsync and rename path
Actual acceptance
Tests hold genuine Windows deletion-denying file handles, release a transient lock on another thread, retain permanent locks, cancel during retry and attempt read-only replacement
Each Windows target also performs 500 complete atomic replacements and 50 actual document saves with native reload, preserving source bytes and checking staging-file cleanup
A separate WinAPI-only probe reproduces the original intermittent access-denied failure without HotPDF or Cairo; this identifies the publication boundary without attributing the cause to an unobserved process