fix(preprocess): harden crash recovery integrity

harness/tht/corpus/store.py

@@ -46,6 +46,7 @@ class CorpusStore:
         self.root = Path(root)
         self.active_path = self.root / "ACTIVE"
         self._replace = os.replace
+        self._fsync_directory = self._sync_root
         self._ensure_root()
 
     def _ensure_root(self) -> None:
@@ -110,15 +111,35 @@ class CorpusStore:
         manifest = self.manifest(generation)
         if manifest.manifest_id != generation:
             raise UnsafeCorpusPath("manifest generation mismatch")
+        if self.active_generation() == generation:
+            return generation
+        previous = self.active_generation()
         temporary = self.active_path.with_name(f".ACTIVE.{uuid.uuid4().hex}.tmp")
-        _atomic_write(temporary, (generation + "\n").encode())
-        self._replace(temporary, self.active_path)
+        replaced = False
+        try:
+            _atomic_write(temporary, (generation + "\n").encode())
+            self._replace(temporary, self.active_path)
+            replaced = True
+            self._fsync_directory()
+        except BaseException:
+            temporary.unlink(missing_ok=True)
+            if replaced:
+                if previous is None:
+                    self.active_path.unlink(missing_ok=True)
+                else:
+                    rollback = self.active_path.with_name(f".ACTIVE.rollback.{uuid.uuid4().hex}.tmp")
+                    _atomic_write(rollback, (previous + "\n").encode())
+                    self._replace(rollback, self.active_path)
+                self._sync_root()
+            raise
+        return generation
+
+    def _sync_root(self) -> None:
         directory = os.open(self.root, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
         try:
             os.fsync(directory)
         finally:
             os.close(directory)
-        return generation
 
     def active_generation(self) -> str | None:
         try: