Distinguish post-replacement durability errors from unchanged reconciliation state

[codeforester]

Goal

Ensure reconciliation failure diagnostics truthfully describe whether a new snapshot was published.

Background

Engineering review of fe18c37a89edc9e2fa6101906385e49338de7312 on 2026-10-03. Original developer checkouts were preserved.

After a successful reconciliation at 2.6.0, an isolated fixture injected EIO only when os.fsync received a directory FD. Reconciliation to 2.7.0 exited 1 and printed the previous snapshot was left unchanged, but last-reconciliation.json contained target_version=2.7.0.

_replace_state performs os.replace before opening/fsyncing the parent directory; the caller handles every exception as if publication had not occurred. Closed #30 added useful atomic replacement coverage, but its failure test replaces the entire _replace_state function with an exception before publication and therefore misses the real post-commit boundary. Reproduced against released base-cli 0.4.3; this is consumer-owned persistence logic.

Scope

Separate staging, atomic publication and durability confirmation, and report the actual commit state after each failure.

Acceptance Criteria

• Pre-replacement failures preserve existing bytes and say so accurately.
• After replacement succeeds, directory-open/fsync failure never claims the previous snapshot survived.
• Define whether unsupported directory fsync is a documented warning or durability failure; do not attempt an unsafe blind rollback over a concurrent writer.
• Fault-injection tests target serialization, file flush, replacement, directory open and directory fsync individually, asserting both bytes and user-facing messages.
• No staged-file residue remains and dry-run remains mutation-free.

Validation

Use base_cli.testing.invoke with a temporary home, inject fsync failure only for directory descriptors, inspect snapshot bytes, and run ./tests/validate.sh with released and candidate framework environments.

Evidence

• src/base_cli_demo/cli.py
• tests/test_cli.py

Non-Goals

No unrelated architecture rewrite, release publication, or automatic live repository-policy change as part of review intake. Implementation follows the issue-backed worktree and reviewed PR workflow.

Project Fields

• Status: Ready
• Priority: P2
• Area: Runtime
• Initiative: Base-CLI Demo
• Size: S
• Issue type: Bug
• Assignee: codeforester
• Scheduling: milestone and target date intentionally uncommitted; this review does not make a delivery-date promise.

Agent Assignment

Assignee: @codeforester. The reproduced behavior and acceptance criteria define the implementation boundary.