ww: invalidate partial package commits

docs/build-system.md

@@ -4558,7 +4558,17 @@ loader-owned deterministic error before producers. Compiler-owned scope or use
 errors may invoke the compiler, but the driver removes that action's staged
 `.new` unit/export/assembly/object/archive files instead of renaming them. No
 completion/status marker is written, and no publication occurs after a failed
-compile.
+compile. If an artifact rename itself fails after an earlier rename has
+published part of a new generation, the driver removes every committed unit
+voucher as well as the remaining staged files. Before the first artifact
+rename, it must successfully remove the workdir identity stamp; failure is a
+pre-commit rejection that leaves the prior artifact generation untouched. The
+stamp remains absent after any partial commit, and later actions in that
+invocation cannot take the freshness shortcut. Each non-reusable action also
+loses its old unit voucher before its producers run. The next request must
+therefore rebuild the incomplete action set and reconsider direct importers; a
+partly replaced `.wwi` or a failed importer can never make an old importer
+voucher look fresh.
 
 Package kind follows the declaration. `package main`, not a path component,
 marks a command. A path ending in `main` remains importable when it declares a