fix: harden Pi lifecycle recovery

backend/test/settings-store.test.ts

@@ -1,5 +1,5 @@
 import { test, expect } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, fsyncSync, mkdtempSync, openSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { loadSettings, saveSettings } from "../src/settings/settings-store.js";
@@ -45,3 +45,28 @@ test("loadConfig sets settingsFile from SETTINGS_FILE, default data/settings.jso
   expect(loadConfig({}).settingsFile).toBe("data/settings.json");
   expect(loadConfig({ SETTINGS_FILE: "/x/y.json" }).settingsFile).toBe("/x/y.json");
 });
+
+test("saveSettings restores the previous file when post-rename directory durability fails", () => {
+  const dir = mkdtempSync(join(tmpdir(), "tht-set-transaction-"));
+  try {
+    const cfg = cfgWith(join(dir, "settings.json"));
+    saveSettings(cfg, { provider: "old", model: "old-model", thinking: "low" });
+    let syncs = 0;
+    expect(() => saveSettings(
+      cfg,
+      { provider: "new", model: "new-model", thinking: "high" },
+      {
+        syncDirectory(directory: string) {
+          syncs += 1;
+          if (syncs === 1) throw new Error("injected directory fsync failure");
+          const fd = openSync(directory, "r");
+          try { fsyncSync(fd); } finally { closeSync(fd); }
+        },
+      },
+    )).toThrow(/directory fsync failure/);
+    expect(loadSettings(cfg)).toEqual({ provider: "old", model: "old-model", thinking: "low" });
+    expect(syncs).toBeGreaterThanOrEqual(2);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});