The lifecycle should treat a temporary artifact as an owned resource with one publisher and one cleanup path. I would use a secure OS/application-approved temp directory, create a unique file atomically with restrictive permissions, write/flush as required, and publish with an atomic rename only after validation. Cancellation and exceptions close handles and remove unpublished artifacts; crash leftovers are identified by scoped naming/metadata and scavenged only when ownership/age rules prove they are stale. Tests: simultaneous workers, forced name collision, cancellation during write, crash leftover, failed rename, permission check, symlink/race attempt, disk-full/ENOSPC, normal publish, and cleanup idempotency. Do not move sensitive temp data outside the approved root.