# Preserve masters across Watch transfer lifetimes

WatchConnectivity owns the received temporary file and removes it after its delegate callback returns. Copy that file synchronously to a unique inbox path before hopping to the main actor. Never use sender filenames to choose a destination or unpack into existing immutable masters.

Outgoing ZIPs are staging copies, separate from master sessions. Keep a staging file while its transfer is outstanding; reconcile outbox files against outstanding transfer URLs after activation and completion. Skip reconciliation during archive preparation because that file has not yet been registered with WatchConnectivity. Registration and cleanup must remain on the same actor without a suspension between them.

Regression checks cover loss of the incoming temporary source, repeated receipt without overwrite, pending-transfer preservation and unchanged original bytes. These establish local file lifecycle behavior; physical transfer completion and receiver retention still need paired-device verification.