From 8fe9e3c3fef0049df82281a62afe35dda516dfe2 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 17:48:26 -0400
Subject: fix: close combat ghost, admin traversal, login throttle, journal
 double-pay, and quality/economy gaps

---
 internal/persistence/atomic.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'internal/persistence')

diff --git a/internal/persistence/atomic.go b/internal/persistence/atomic.go
index a3cc06a..2b24391 100644
--- a/internal/persistence/atomic.go
+++ b/internal/persistence/atomic.go
@@ -3,11 +3,19 @@
 package persistence
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 )
 
+// ErrDurabilityUncertain reports that the atomic replacement was renamed into
+// place but the directory could not be synced (or a post-rename chmod
+// failed). The new content is visible to readers, but a crash may still lose
+// it. Callers that must distinguish "nothing happened" from "the replacement
+// landed but may not survive a crash" should test errors.Is against this.
+var ErrDurabilityUncertain = errors.New("replacement completed; durability uncertain")
+
 // WriteFile writes and syncs a temporary file in the destination directory,
 // atomically renames it over path, then syncs the directory. Existing file
 // permissions are preserved; perm is used for new files. Callers must own the
@@ -43,11 +51,11 @@ func WriteFile(path string, data []byte, perm os.FileMode) error {
 	}
 	d, err := os.Open(dir)
 	if err != nil {
-		return fmt.Errorf("replacement completed; open directory for sync: %w", err)
+		return fmt.Errorf("%w: open directory for sync: %v", ErrDurabilityUncertain, err)
 	}
 	defer d.Close()
 	if err := d.Sync(); err != nil {
-		return fmt.Errorf("replacement completed; sync directory: %w", err)
+		return fmt.Errorf("%w: sync directory: %v", ErrDurabilityUncertain, err)
 	}
 	return nil
 }
-- 
cgit v1.2.3