simulo 0.31.2__tar.gz → 0.33.0__tar.gz

{simulo-0.31.2/src/simulo.egg-info → simulo-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simulo
-Version: 0.31.2
+Version: 0.33.0
 Summary: Python SDK and CLI for cloud-native robotics simulation, reinforcement learning, and robot policy training on managed GPUs.
 Author-email: Simulo Team <team@simulo.ai>
 License: BSD-3-Clause
@@ -31,7 +31,7 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: simulo-interfaces<0.23,>=0.22.0
+Requires-Dist: simulo-interfaces<0.25,>=0.24.0
 Requires-Dist: mcap<2,>=1.3
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: usd-core<27,>=26.5
@@ -94,7 +94,7 @@ simulo login
 cd mybot
 simulo run preview.py --frozen --strict-assets
 simulo run train.py --frozen --strict-assets
-simulo run play.py --policy policy_<job>:best --frozen --strict-assets
+simulo run play.py --policy <policy-id>:best --frozen --strict-assets
 ```
 
 `simulo create` writes a complete starter application to your machine without
@@ -115,7 +115,7 @@ See the repository README for setup and usage.
 
 ```bash
 simulo jobs                       # list submitted jobs and status
-simulo logs --follow              # stream the latest job's logs
+simulo logs --follow              # stream logs from your most recent job you submitted (train, play, preview or eval)
 simulo result                     # read the job's result
 simulo policy list                # list training policies and checkpoints
 simulo policy get policy_x:best   # download a verified checkpoint
@@ -126,8 +126,8 @@ simulo view                       # view a running --viewstream job in 3D
 simulo cancel                     # stop a queued or running job
 ```
 
-Commands that accept a job ID default to the latest job and tell you which job
-they selected.
+Commands that accept a job ID default to the latest user-submitted job
+(`train`, `play`, `preview`, or `eval`) and tell you its ID and type.
 
 ## Use versioned robot assets
 

{simulo-0.31.2 → simulo-0.33.0}/PYPI.md

@@ -38,7 +38,7 @@ simulo login
 cd mybot
 simulo run preview.py --frozen --strict-assets
 simulo run train.py --frozen --strict-assets
-simulo run play.py --policy policy_<job>:best --frozen --strict-assets
+simulo run play.py --policy <policy-id>:best --frozen --strict-assets
 ```
 
 `simulo create` writes a complete starter application to your machine without
@@ -59,7 +59,7 @@ See the repository README for setup and usage.
 
 ```bash
 simulo jobs                       # list submitted jobs and status
-simulo logs --follow              # stream the latest job's logs
+simulo logs --follow              # stream logs from your most recent job you submitted (train, play, preview or eval)
 simulo result                     # read the job's result
 simulo policy list                # list training policies and checkpoints
 simulo policy get policy_x:best   # download a verified checkpoint
@@ -70,8 +70,8 @@ simulo view                       # view a running --viewstream job in 3D
 simulo cancel                     # stop a queued or running job
 ```
 
-Commands that accept a job ID default to the latest job and tell you which job
-they selected.
+Commands that accept a job ID default to the latest user-submitted job
+(`train`, `play`, `preview`, or `eval`) and tell you its ID and type.
 
 ## Use versioned robot assets
 

{simulo-0.31.2 → simulo-0.33.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simulo"
-version = "0.31.2"
+version = "0.33.0"
 description = "Python SDK and CLI for cloud-native robotics simulation, reinforcement learning, and robot policy training on managed GPUs."
 readme = "PYPI.md"
 requires-python = ">=3.11"
@@ -59,7 +59,7 @@ classifiers = [
 # mcap: used by `simulo recordings` to read back a downloaded recording and
 # verify it (message count) — MIT-licensed, deps only lz4+zstandard.
 dependencies = [
-    "simulo-interfaces>=0.22.0,<0.23",
+    "simulo-interfaces>=0.24.0,<0.25",
     "mcap>=1.3,<2",
     # Hardened XML parsing for URDF ingestion (USD Asset Catalogs, PR-12 fix
     # loop 2, security NIT): stdlib xml.etree.ElementTree relies on

{simulo-0.31.2 → simulo-0.33.0}/src/simulo/__init__.py

@@ -59,7 +59,9 @@ Three kinds of name live on ``simulo``:
   prebuilt place you bring, ``World.usd(...)``.)
 """
 
+import dis as _dis
 import pkgutil as _pkgutil
+import sys as _sys
 from typing import TYPE_CHECKING
 
 __path__ = _pkgutil.extend_path(__path__, __name__)
@@ -143,6 +145,8 @@ from simulo.interfaces.authoring import (
     LightConfig,
     PointMarker,
     PolicyCheckpoint,
+    PolicyInput,
+    PolicyInputSchema,
     PrimitiveShape,
     RigidPhysics,
     RoughTerrain,
@@ -188,6 +192,8 @@ __all__ = [
     "JobPublicId",
     "PolicyPublicId",
     "PolicyNetworkProtocol",
+    "PolicyInput",
+    "PolicyInputSchema",
     "RecordingPublicId",
     "OutputPublicId",
     "parse_job_public_id",
@@ -234,6 +240,8 @@ __all__ = [
     "PointMarker",
     # lazy, mode-aware (the learning names + save_output)
     "ActuatorGainsConfig",
+    "ArticulationConfig",
+    "JointConfig",
     "Camera",
     "CameraSpawnConfig",
     "ContactSensor",
@@ -277,11 +285,25 @@ __all__ = [
     "Trainer",
     "Visual",
     "World",
+    "evaluate",
     "preview",
     "save_output",
 ]
 
 
+def _is_from_import_lookup() -> bool:
+    """True when the running lookup is the ``IMPORT_FROM`` of ``from simulo import X``.
+
+    Attribute access and ``hasattr`` keep raising ``AttributeError``; only a ``from``
+    import needs the ``ImportError`` that carries the message. Any doubt answers False.
+    """
+    try:
+        caller = _sys._getframe(2)  # skip this helper and ``__getattr__``
+        return _dis.opname[caller.f_code.co_code[caller.f_lasti]] == "IMPORT_FROM"
+    except (ValueError, IndexError):
+        return False
+
+
 def __getattr__(name: str) -> object:
     """PEP 562 hook: lazily resolve the mode-aware learning names.
 
@@ -298,6 +320,10 @@ def __getattr__(name: str) -> object:
         "run": "simulo.run was removed. Use `simulo run train.py` instead.",
     }
     if name in removed_hints:
+        if _is_from_import_lookup():
+            # CPython swallows an AttributeError raised during ``from simulo import X``
+            # and reports a bare "cannot import name", so the pointer would be lost.
+            raise ImportError(removed_hints[name], name=__name__)
         raise AttributeError(removed_hints[name])
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
@@ -350,11 +376,11 @@ if TYPE_CHECKING:
     # ``simulo.interfaces.authoring`` (``CameraProtocol`` / ``PropProtocol``)
     # and both are instantiated, never subclassed (``simulo.Camera(width=640,
     # ...)``, ``simulo.Prop(shape)``), so each follows the "instantiated mirror
-    # -> facade" rule above exactly. The other 19 names
+    # -> facade" rule above exactly. The other names
     # have no TYPE_CHECKING alias, DELIBERATELY, per the rule's own "where none
     # exists, do not invent one" corollary:
     #   - ``CameraSpawnConfig`` / ``SensorOffset`` / ``RayPattern`` /
-    #     ``ActuatorGainsConfig`` / ``GripperState`` / ``GripperCommand`` /
+    #     ``GripperState`` / ``GripperCommand`` /
     #     ``Simulation`` have no contract Protocol at all — nothing to alias
     #     against.
     #   - ``ContactSensor`` / ``RayCaster`` / ``IMU`` / ``ForceTorqueSensor`` /
@@ -381,6 +407,7 @@ if TYPE_CHECKING:
     from simulo._client.facades import RLPlayer as RLPlayer
     from simulo._client.facades import RLTrainer as RLTrainer
     from simulo._client.facades import Robot as Robot
+    from simulo._client.facades import evaluate as evaluate
     from simulo._client.facades import preview as preview
     from simulo.interfaces.authoring import SceneProtocol
     from simulo.interfaces.runtime import (
@@ -414,7 +441,10 @@ if TYPE_CHECKING:
     # ``simulo.interfaces.authoring`` class in both
     # modes, so these alias the real class — precise field/signature checking
     # (e.g. mypy rejects ``simulo.Pose(xyz="nope")``) instead of ``Any``.
+    from simulo.interfaces.authoring import ActuatorGainsConfig as ActuatorGainsConfig
+    from simulo.interfaces.authoring import ArticulationConfig as ArticulationConfig
     from simulo.interfaces.authoring import Entity as Entity
+    from simulo.interfaces.authoring import JointConfig as JointConfig
     from simulo.interfaces.authoring import Light as Light
     from simulo.interfaces.authoring import Material as Material
     from simulo.interfaces.authoring import Physics as Physics

{simulo-0.31.2 → simulo-0.33.0}/src/simulo/_client/_runner.py

@@ -92,6 +92,7 @@ class JobHandle:
         token: Optional[str] = None,
         job_type: Optional[JobType] = None,
         input_checkpoint: Optional[str] = None,
+        compare_checkpoint: Optional[str] = None,
         deferred_stdout: str = "",
         deferred_stderr: str = "",
     ) -> None:
@@ -104,6 +105,7 @@ class JobHandle:
         self._token = token
         self._job_type = job_type
         self._input_checkpoint = input_checkpoint
+        self._compare_checkpoint = compare_checkpoint
         self._deferred_stdout = deferred_stdout
         self._deferred_stderr = deferred_stderr
 
@@ -152,6 +154,11 @@ class JobHandle:
         """Policy checkpoint requested with ``simulo run --from``."""
         return self._input_checkpoint
 
+    @property
+    def compare_checkpoint(self) -> Optional[str]:
+        """Policy checkpoint requested with ``simulo run --compare``."""
+        return self._compare_checkpoint
+
     @property
     def deferred_stdout(self) -> str:
         """Submit-time output held until the cloud job header is printed."""

{simulo-0.31.2 → simulo-0.33.0}/src/simulo/_client/_secure_downloads.py

@@ -2,7 +2,7 @@
 
 THE RACE THIS CLOSES. The bulk download path validates its assembled
 filename and the selected destination directory as PATH STRINGS
-(``_contained_bulk_download_destination`` in ``cli.py``: resolve, then
+(``_contained_bulk_download_destination`` in ``cli_downloads.py``: resolve, then
 ``relative_to``) before any bytes are fetched. The actual write — inside
 this client's checkpoint/output/recording download paths
 — re-derives the SAME destination from its path string again, after a
@@ -112,6 +112,7 @@ from __future__ import annotations
 
 import ctypes
 import errno
+import logging
 import os
 import secrets
 import stat as stat_module
@@ -136,7 +137,8 @@ class DestinationDirectoryError(OSError):
 
     An ``OSError`` subclass so every existing ``except (OSError, ValueError)``
     around a download write (``_download_and_report`` and its Model/Output
-    counterparts in ``cli.py``) already reports it as one clean CLI line;
+    counterparts in ``commands/jobs.py``, ``commands/policies.py``, and
+    ``commands/recordings.py``) already reports it as one clean CLI line;
     no caller needs a new except clause to handle this module's refusals.
     """
 
@@ -155,6 +157,38 @@ def _retained_temp_error(
     )
 
 
+def _write_failure_error(
+    destination_display_path: Path,
+    final_name: str,
+    temp_name: str,
+    exc: Exception,
+    *,
+    discarded: bool,
+    existing_final_preserved: bool = False,
+) -> DestinationDirectoryError:
+    """The error for a write that failed before publication.
+
+    When the temporary entry was removed the user needs only the reason; the
+    retained-entry wording is for the case where it could not be removed.
+    """
+    if not discarded:
+        return _retained_temp_error(
+            destination_display_path, temp_name, exc, existing_final_preserved=existing_final_preserved
+        )
+    if isinstance(exc, DestinationDirectoryError):
+        return exc
+    return DestinationDirectoryError(
+        f"Could not write {final_name!r} into {destination_display_path}: {exc}. " "The partial download was removed."
+    )
+
+
+def _existing_final_message(final_name: str, destination_display_path: Path) -> str:
+    return (
+        f"{final_name!r} already exists in {destination_display_path}; "
+        "remove it, or download it to another folder with -o DIR."
+    )
+
+
 def _close_fd_quietly(fd: int) -> None:
     try:
         os.close(fd)
@@ -194,8 +228,8 @@ _TEMP_NAME_ATTEMPTS = 64
 # or an existing final entry is left untouched.  ``link`` followed by
 # ``unlink`` cannot offer that postcondition because a process death between
 # those calls leaves both names behind.  Keep the optional libc binding at
-# module scope so unsupported libc/platform combinations are explicitly
-# refused rather than silently falling back to replacement.
+# module scope; a libc, platform or filesystem without the primitive falls back
+# to :func:`_publish_by_link`, which still never replaces an existing file.
 _AT_FDCWD = -100
 _RENAME_NOREPLACE = 1
 _RENAME_EXCL = 0x00000004
@@ -221,14 +255,16 @@ def _rename_noreplace(
     *,
     src_dir_fd: Optional[int] = None,
     dst_dir_fd: Optional[int] = None,
-) -> None:
+) -> bool:
     """Atomically publish *source* at absent *destination*, or fail closed.
 
     Linux uses ``renameat2(RENAME_NOREPLACE)`` and macOS uses
     ``renameatx_np(RENAME_EXCL)``.  Windows' native ``os.rename`` refuses an
-    existing destination. Other platforms deliberately refuse the
-    server-derived no-clobber path instead of using a two-name link/unlink
-    sequence or replacing an existing file. Explicit user file targets keep
+    existing destination. Where the platform, or the filesystem under the
+    destination (an NTFS or FAT mount), has no such primitive,
+    :func:`_publish_by_link` publishes without ever replacing an existing
+    file. Return ``True`` when linking leaves the temporary name for the caller
+    to discard after recording publication. Explicit user file targets keep
     using ``os.replace`` through ``replace_existing=True``.
     """
     if os.name == "nt":
@@ -237,7 +273,7 @@ def _rename_noreplace(
                 "This platform cannot atomically publish a server-named download through directory descriptors."
             )
         os.rename(source, destination)
-        return
+        return False
     if sys.platform.startswith("linux"):
         rename_function = _renameat2
         flag = _RENAME_NOREPLACE
@@ -248,9 +284,8 @@ def _rename_noreplace(
         rename_function = None
         flag = 0
     if rename_function is None:
-        raise DestinationDirectoryError(
-            "This platform cannot atomically publish a server-named download without replacing an existing file."
-        )
+        _publish_by_link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd)
+        return True
     old_dir_fd = _AT_FDCWD if src_dir_fd is None else src_dir_fd
     new_dir_fd = _AT_FDCWD if dst_dir_fd is None else dst_dir_fd
     ctypes.set_errno(0)
@@ -262,17 +297,43 @@ def _rename_noreplace(
         flag,
     )
     if result == 0:
-        return
+        return False
     error_number = ctypes.get_errno()
     if error_number == errno.EEXIST:
         raise FileExistsError(error_number, os.strerror(error_number), destination)
-    if error_number in (errno.EINVAL, errno.ENOSYS, errno.EOPNOTSUPP):
-        raise DestinationDirectoryError(
-            "This filesystem cannot atomically publish a server-named download without replacing an existing file."
-        )
+    if error_number in (errno.EINVAL, errno.ENOSYS, errno.EOPNOTSUPP, errno.ENOTSUP):
+        # The filesystem (an NTFS or FAT mount, a network share) does not
+        # implement the no-replace flag.
+        _publish_by_link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd)
+        return True
     raise OSError(error_number, os.strerror(error_number), destination)
 
 
+def _publish_by_link(
+    source: str,
+    destination: str,
+    *,
+    src_dir_fd: Optional[int] = None,
+    dst_dir_fd: Optional[int] = None,
+) -> None:
+    """Publish with an atomic no-clobber hard link.
+
+    Unlike an exclusive-create claim followed by replacement, ``link`` refuses
+    any occupied destination at publication time. The caller discards the
+    temporary name after recording publication, checking its identity first.
+    Filesystems without hard links are refused rather than risking replacement.
+    """
+    try:
+        os.link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd, follow_symlinks=False)
+    except FileExistsError:
+        raise
+    except (OSError, NotImplementedError) as exc:
+        raise DestinationDirectoryError(
+            "This filesystem cannot safely publish a download without replacing an existing file: "
+            f"the atomic hard link failed ({exc}). Choose another download folder with -o DIR."
+        ) from exc
+
+
 def _random_temp_name(final_name: str) -> str:
     """One candidate temp-file name for ``final_name``, unpredictable
     enough that an attacker cannot pre-plant a symlink at it — the
@@ -362,19 +423,62 @@ class DestinationDirectory:
         A same-directory temporary file is written, flushed, and ``fsync``'d,
         then published atomically. With ``replace_existing=True`` it replaces
         a prior complete entry; otherwise publication fails if *any* final
-        entry already exists. Any failure after temporary-file creation may
-        leave that mode-0600 ``.part`` entry behind. No backend deletes it
-        automatically because a pathname can be replaced before cleanup.
-        Ordinary write and publication errors name the temporary entry and ask
-        the operator to locate and verify it before manual cleanup.
-        ``KeyboardInterrupt`` and
-        ``SystemExit`` are re-raised unchanged; their possible residue is
-        documented here rather than reported while interrupting the caller.
+        entry already exists. After any failure before publication the
+        temporary entry is removed, but only when the name still refers to the
+        very file this call created (same device and inode, and for the
+        path-based writer the same directory): a pathname can be replaced
+        before cleanup, and an entry that is no longer provably ours is left
+        alone. Then the error says plainly why the write failed. Only when
+        that entry cannot be removed does the error name the retained
+        mode-0600 ``.part`` entry and ask the operator to locate and verify it
+        before manual cleanup. ``KeyboardInterrupt`` and ``SystemExit``
+        remove the entry the same way and are re-raised unchanged.
+        When publication uses a hard link, the completed temporary name is
+        removed using the same identity check; failed cleanup is reported.
         ``final_name`` must be a bare basename (no path separators); see
         :func:`_validate_leaf_name`.
         """
         raise NotImplementedError
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        raise NotImplementedError
+
+    def _discard_linked_temp(self, final_name: str, temp_name: str, identity: tuple[int, int]) -> None:
+        if not self._discard_temp(temp_name, identity):
+            logging.getLogger(__name__).warning(
+                "Download %r was published in %s. Temporary entry %r could not be safely removed. "
+                "Verify its identity before manual cleanup.",
+                final_name,
+                self.display_path,
+                temp_name,
+            )
+
+    def _unpublished_failure(
+        self,
+        final_name: str,
+        temp_name: str,
+        identity: Optional[tuple[int, int]],
+        exc: BaseException,
+        existing_final_preserved: bool,
+    ) -> Optional[DestinationDirectoryError]:
+        """Remove the unpublished temp entry; return the error to raise instead of *exc*.
+
+        ``None`` means re-raise *exc* unchanged: an interrupt or exit, or an
+        error that already says what it needs to.
+        """
+        discarded = self._discard_temp(temp_name, identity)
+        if not isinstance(exc, Exception):
+            return None
+        error = _write_failure_error(
+            self.display_path,
+            final_name,
+            temp_name,
+            exc,
+            discarded=discarded,
+            existing_final_preserved=existing_final_preserved,
+        )
+        return None if error is exc else error
+
     def close(self) -> None:
         raise NotImplementedError
 
@@ -455,29 +559,45 @@ class _DirFdDestinationDirectory(DestinationDirectory):
             f"Refusing to publish {final_name!r}: portable-equivalent alias {aliases[0]!r} exists."
         )
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        """Remove the temporary entry this call created; ``True`` when it is gone.
+
+        The held directory descriptor pins the directory, so only the entry's
+        name can have changed. It is removed only while it still has the
+        identity of the file this call created. A name that now refers to
+        anything else is left alone.
+        """
+        try:
+            if identity is None:
+                return False
+            current = os.stat(temp_name, dir_fd=self._fd, follow_symlinks=False)
+            if (current.st_dev, current.st_ino) != identity:
+                return False
+            os.unlink(temp_name, dir_fd=self._fd)
+        except FileNotFoundError:
+            return True
+        except OSError:
+            return False
+        return True
+
     def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
         if not replace_existing:
             self._refuse_portable_alias(final_name)
         fd, temp_name = self._mkstemp(final_name)
+        identity: Optional[tuple[int, int]] = None
+        published = False
+        existing_final_preserved = False
         try:
-            published_identity = os.fstat(fd)
-        except (KeyboardInterrupt, SystemExit):
-            _close_fd_quietly(fd)
-            raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
-        try:
+            created = os.fstat(fd)
+            identity = (created.st_dev, created.st_ino)
             handle = os.fdopen(fd, "wb")
-        except (KeyboardInterrupt, SystemExit):
+        except BaseException as exc:
             _close_fd_quietly(fd)
+            replacement = self._unpublished_failure(final_name, temp_name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
             raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
-        published = False
-        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
@@ -488,25 +608,24 @@ class _DirFdDestinationDirectory(DestinationDirectory):
                 published = True
             else:
                 try:
-                    _rename_noreplace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
+                    linked = _rename_noreplace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
                 except FileExistsError as exc:
                     existing_final_preserved = True
-                    raise DestinationDirectoryError(
-                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
-                        "The existing final entry was preserved."
-                    ) from exc
+                    raise DestinationDirectoryError(_existing_final_message(final_name, self.display_path)) from exc
                 published = True
-                self._refuse_portable_alias(
-                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
-                )
-        except (KeyboardInterrupt, SystemExit):
-            raise
-        except Exception as exc:
+                assert identity is not None
+                try:
+                    self._refuse_portable_alias(final_name, published_identity=identity)
+                finally:
+                    if linked:
+                        self._discard_linked_temp(final_name, temp_name, identity)
+        except BaseException as exc:
             if published:
                 raise
-            raise _retained_temp_error(
-                self.display_path, temp_name, exc, existing_final_preserved=existing_final_preserved
-            ) from exc
+            replacement = self._unpublished_failure(final_name, temp_name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
+            raise
 
     def close(self) -> None:
         if not self._closed:
@@ -599,31 +718,48 @@ class _PathIdentityDestinationDirectory(DestinationDirectory):
             )
         raise DestinationDirectoryError(f"Refusing to publish {final_name!r}: portable-equivalent alias exists.")
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        """Remove the temporary entry this call created; ``True`` when it is gone.
+
+        Nothing holds this directory, so the directory is re-verified first and
+        the entry is removed only while it still has the identity of the file
+        this call created. Anything else is left alone.
+        """
+        try:
+            if identity is None:
+                return False
+            self._verify_unchanged()
+            temp_path = os.fspath(self.display_path / temp_name)
+            current = os.stat(temp_path, follow_symlinks=False)
+            if (current.st_dev, current.st_ino) != identity:
+                return False
+            os.unlink(temp_path)
+        except FileNotFoundError:
+            return True
+        except OSError:
+            return False
+        return True
+
     def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
         self._verify_unchanged()
         if not replace_existing:
             self._refuse_portable_alias(final_name)
         fd, temp_path = self._mkstemp(final_name)
-        try:
-            published_identity = os.fstat(fd)
-        except (KeyboardInterrupt, SystemExit):
-            _close_fd_quietly(fd)
-            raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
+        identity: Optional[tuple[int, int]] = None
         final_path = self.display_path / final_name
+        published = False
+        existing_final_preserved = False
         try:
+            created = os.fstat(fd)
+            identity = (created.st_dev, created.st_ino)
             handle = os.fdopen(fd, "wb")
-        except (KeyboardInterrupt, SystemExit):
+        except BaseException as exc:
             _close_fd_quietly(fd)
+            replacement = self._unpublished_failure(final_name, temp_path.name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
             raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
-        published = False
-        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
@@ -635,25 +771,24 @@ class _PathIdentityDestinationDirectory(DestinationDirectory):
                 published = True
             else:
                 try:
-                    _rename_noreplace(os.fspath(temp_path), os.fspath(final_path))
+                    linked = _rename_noreplace(os.fspath(temp_path), os.fspath(final_path))
                 except FileExistsError as exc:
                     existing_final_preserved = True
-                    raise DestinationDirectoryError(
-                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
-                        "The existing final entry was preserved."
-                    ) from exc
+                    raise DestinationDirectoryError(_existing_final_message(final_name, self.display_path)) from exc
                 published = True
-                self._refuse_portable_alias(
-                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
-                )
-        except (KeyboardInterrupt, SystemExit):
-            raise
-        except Exception as exc:
+                assert identity is not None
+                try:
+                    self._refuse_portable_alias(final_name, published_identity=identity)
+                finally:
+                    if linked:
+                        self._discard_linked_temp(final_name, temp_path.name, identity)
+        except BaseException as exc:
             if published:
                 raise
-            raise _retained_temp_error(
-                self.display_path, temp_path.name, exc, existing_final_preserved=existing_final_preserved
-            ) from exc
+            replacement = self._unpublished_failure(final_name, temp_path.name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
+            raise
 
     def close(self) -> None:
         self._closed = True