UQ-PERSISTENCE-CLEANUP-FENCING-001.
UQStateSave(): the shared '<primary>.tmp' staging name is replaced by an operation-scoped locator (V2 fingerprint + fixed 20 character operation tag: 12 hex instance seed and 8 hex monotonic counter). The tag keeps the whole name at 104 characters, well inside the MAX_PATH bound, and can never equal the '.cfg' primary or the '.bak' backup. The unconditional pre-write FileDelete() is removed because the name is private to the operation.
Every save failure path now calls UQStateDiscardTemp(), which re-verifies ownership at the moment of the removal and leaves the operation-owned temporary file as an orphan when ownership is lost. No shared, foreign or unidentifiable temporary file is deleted and no scope-wide sweep is added.
CUQRisk::ApplyResetRequest(): a failed initialization-marker update no longer calls GlobalVariableDel(). The marker keeps its previous value, the reset is reported as rejected and the evidence is preserved instead of being converted into marker absence. No marker-removal operation remains in the risk controller.
No change to the V2 fingerprint, primary/backup locators, legacy migration rules, guard or ballot protocol, risk limits or strategy.
Chiki Bum
5cb0c5b7cf