A crash-left branch-removal temp file from a pre-#3763 dev build could revive a cancelled removal #3773

What happens

#3763 counts a crash-left `removal-pending`.partial as an owed branch removal, because the crash can leave that temp file alone after the drop has already removed the app.

Builds of main between #3600 (merged 2026-10-29) and #3763 had a gap. If one of those builds left a .partial from a crash, and its next drop of the app used keepBranches, that drop cleared only the marker. Upgrading such a node to #3763 would then read the leftover .partial as owed, and delete forks the operator chose to keep.

No release can reach this: v5.4.0-alpha.1 came out before #3600 merged, and #3600 has no backport. Only a node that ran a development build of main in that window, crashed mid-write during a discarding drop, then dropped again with keepBranches, and was upgraded in place could hit it.

If it ever matters

Give the record a drop writes after removeApplication its own temp file name, and count only that name as owed. A .partial with the original name would then never authorize a removal.

Review-Deferral: 205923d1d2d513b0 severity=nit category=data-integrity

_{🤖 Generated by Anthropic Claude (Opus 5.5); posted via @dawsontoth.}