inflight.json is truncated before it is written, so a crash drops every turn it was meant to resume #2705

Written-by: Chief

inflight.json — the record that lets an interrupted turn resume — is written in place: the writer truncates the file and then writes the new bytes (core/src/host/resume.js). A crash in that window leaves an empty or half-written file, and the reader schedules no pickup at all for a file it cannot parse, so every interrupted turn in it is dropped silently on the next start.

Reproduction (main 71855d9d7b1ffabb3fca334452d753543558cfcb)

/data/dsh/bot/workspace/audit46/shutdown.test.mjs, tests F3 and F3b (real modules, real child process, real kill -9):

• intact file → fakeResume(file).timers is [3000] (the pickup is scheduled);
• empty file → [] — no pickup, no warning;
• the first half of the bytes → [] — same;
• reverse control: the atomic shape (temp file + rename) keeps the previous complete file when the temp write is cut off, and the pickup is still scheduled from it ([3000]).
• F3b shows the real writer reaches the torn state: it truncates before it writes, so kill -9 inside that window leaves an empty inflight.json.

Why it matters

The file exists for exactly one situation — the process died with turns in flight — and that is also the only situation in which a torn write is possible. So the recovery mechanism fails precisely when it is needed: the user's interrupted turns are never resumed, and nothing says so. The next start finds an empty file and reports a clean state.

Expected

Write inflight.json the way this repository already writes its other state: a temp file in the same directory (explicit 0600), then rename over the real path, so a crash leaves either the old complete file or the new complete file. A file that still cannot be parsed (a hand-edit, a disk error) should say so once (warn) rather than pass for "nothing to resume".

Change scope

core/src/host/resume.js (the writer; the reader's scheduling rule stays), plus a test that asserts the atomic shape — either the previous bytes or the new bytes after a cut-off write, never an empty file.