The signatureEACCES, EPERM, or unsupported link ...tmp → session.jsonl.zstd during the first Session flush.

Why ordinary rename is unsafe.

Hard linkNo overwrite

The final path appears complete and an existing log wins with EEXIST.

POSIX renameSilent replacement

A racing materializer can replace the committed final path.

Exclusive copyPartial visibility

The destination may be visible before copying and syncing finish.

Recover on a capable local filesystem.

- id: session-persistence-jsonl
  config:
    root: /local-durable-storage/dsh-sessions

Put the override in $DSH_HOME/cordis.patch.yml. Stop every writer, copy existing Session directories with metadata preserved, inspect dsh --profile web --dump-config, then test create, append, restart, and resume in a disposable Session.

Probe

Two names show one inode.

Quiesce

No old or new writer remains live.

Migrate

Ownership, permissions, names, and timestamps survive.

Prove

First flush and restart both succeed.

Do not patch Node fs globally.

A broad link()-to-copy shim changes every caller and cannot preserve complete-before-visible semantics. A real fallback needs cross-process no-clobber publication and crash tests.

Route the error.

First Session flushlink ...tmp

POSIX JSONL materialization capability.

Settings saverename ...tmp

Generic atomic replacement path.

pnpm installstore/import error

Package-manager topology, not Session persistence.

Primary evidence.

Preserve all three properties.

The full runbook includes a filesystem probe, immediate-response steps, whole-home and Session-only migration, fallback semantics, error routing, and twelve upstream acceptance gates.

Read the complete runbook