Publish when complete, clean up however it ends — cheat sheet

set -euo pipefail
work=$(mktemp)                                  # private, 0600, honours TMPDIR
part=$(mktemp "$DEST/.orders.XXXXXX")           # same directory as the final file
cleanup() { rm -f -- "$work" "$part"; }
trap cleanup EXIT            # bash: also runs when SIGTERM/SIGINT/SIGHUP kill the script

produce > "$part"
chmod 644 "$part"
mv -f -- "$part" "$DEST/$name"                  # atomic within one file system

long_command & wait $!                          # a trapped signal interrupts wait
setsid cmd & kill -TERM -- -$!                  # signal a whole process group