@@ -24,13 +24,18 @@ const targetPath = path.resolve(process.env.INTERRUPTION_TARGET_PATH)
 const fsPromises = require("fs/promises")
 const actualRename = fsPromises.rename
 
-// Fault injection: die with code 0 before the replacement lands. Any rename
+// Fault injection: hard-kill before the replacement lands. Any rename
 // whose destination is the canonical path is the commit step, whatever
 // replacement protocol the writer uses; exit before performing it.
+let commitAttempts = 0
 fsPromises.rename = function interruptionRename(oldPath, newPath) {
 	if (path.resolve(String(newPath)) === targetPath) {
+		commitAttempts++
+		if (process.env.INTERRUPTION_MODE === "fallback" && commitAttempts === 1) {
+			return Promise.reject(Object.assign(new Error("Injected EPERM"), { code: "EPERM" }))
+		}
 		fs.writeSync(1, "EXIT_BEFORE_REPLACEMENT_RENAME\\n")
-		process.exit(0)
+		process.kill(process.pid, "SIGKILL")
 	}
 	return actualRename.apply(fsPromises, arguments)
 }
@@ -104,9 +109,9 @@ describe("safeWriteJson subprocess interruption fault injection", () => {
 		await fs.rm(tempDir, { recursive: true, force: true })
 	})
 
-	it.each([1, 2, 3])(
-		"keeps the committed file readable when the writer dies before the replacement lands (run %i)",
-		async (run) => {
+	it.each(["atomic", "fallback"] as const)(
+		"preserves committed history when the %s writer is killed before replacement",
+		async (mode) => {
 			// A previously committed write contains the restart marker.
 			const committed = { ui_messages: [{ ts: 1, type: "say", text: "RESTART_PERSISTENCE_MARKER" }] }
 			await fs.writeFile(targetPath, JSON.stringify(committed), "utf8")
@@ -123,8 +128,9 @@ describe("safeWriteJson subprocess interruption fault injection", () => {
 				env: {
 					...process.env,
 					INTERRUPTION_TARGET_PATH: targetPath,
+					INTERRUPTION_MODE: mode,
 					INTERRUPTION_PAYLOAD: JSON.stringify({
-						ui_messages: [{ ts: 2, type: "say", text: `INTERRUPTED_WRITE_${run}` }],
+						ui_messages: [{ ts: 2, type: "say", text: `INTERRUPTED_WRITE_${mode}` }],
 					}),
 					ESBUILD_PATH: esbuildPath,
 					SAFE_WRITE_JSON_ENTRY: safeWriteJsonEntryPath,
@@ -137,23 +143,32 @@ describe("safeWriteJson subprocess interruption fault injection", () => {
 			expect(exit.stdout).toContain("EXIT_BEFORE_REPLACEMENT_RENAME")
 			expect(exit.stdout).not.toContain("WRITE_COMPLETED")
 			expect(exit.stderr).not.toContain("WRITE_FAILED")
-			expect(exit.code).toBe(0)
-
-			// The writer terminated before the replacement rename, so the
-			// canonical path must still hold the last committed content. This
-			// is the permanent-ENOENT regression: with the old two-rename
-			// protocol the committed target was already renamed away, and no
-			// read retry could bring it back.
-			const after = JSON.parse(await readFileWithMissingRetry(targetPath))
-			expect(after).toEqual(committed)
-
-			// Restart recovery: remove the advisory lock file orphaned by the
-			// dead writer (proper-lockfile would only treat it as stale after
-			// 31 seconds), then a fresh write must succeed and consume the
-			// interrupted write's leftovers.
-			await fs.rm(`${targetPath}.lock`, { force: true })
+			expect(exit.code).toBeNull()
+
+			// Atomic replacement retains the canonical file; the two-step
+			// fallback retains committed content in its backup until recovery.
+			const interruptedFiles = await fs.readdir(storageDir)
+			expect(interruptedFiles.filter((entry) => entry.includes(".new_"))).toHaveLength(1)
+			if (mode === "fallback") {
+				await expect(fs.readFile(targetPath)).rejects.toMatchObject({ code: "ENOENT" })
+				const backups = interruptedFiles.filter((entry) => entry.includes(".bak_"))
+				expect(backups).toHaveLength(1)
+				expect(JSON.parse(await fs.readFile(path.join(storageDir, backups[0]), "utf8"))).toEqual(committed)
+			} else {
+				expect(JSON.parse(await readFileWithMissingRetry(targetPath))).toEqual(committed)
+			}
+
+			// SIGKILL leaves the lock behind. Age it to exercise real stale-lock
+			// acquisition without making the test wait through the stale window.
+			const staleTime = new Date(Date.now() - 60_000)
+			await fs.utimes(`${targetPath}.lock`, staleTime, staleTime)
 			const recovered = { ui_messages: [{ ts: 3, type: "say", text: "RECOVERED_AFTER_RESTART" }] }
-			await safeWriteJson(targetPath, recovered)
+			await safeWriteJson(targetPath, recovered, {
+				merge: (existing, incoming) => {
+					expect(existing).toEqual(committed)
+					return incoming
+				},
+			})
 
 			expect(JSON.parse(await readFileWithMissingRetry(targetPath))).toEqual(recovered)
 			const leftovers = (await fs.readdir(storageDir)).filter(
 
@@ -439,7 +439,7 @@ describe("safeWriteJson", () => {
 
 	// Test for rollback failure scenario
 	test("should log error and re-throw original if rollback fails", async () => {
-		const initialData = { message: "Initial, should be lost if rollback fails" }
+		const initialData = { message: "Initial, preserved if rollback fails" }
 		const newData = { message: "New content" }
 
 		await fsPromisesActuals.writeFile!(currentTestFilePath, JSON.stringify(initialData))
@@ -471,6 +471,16 @@ describe("safeWriteJson", () => {
 		// is only logged.
 		await expect(safeWriteJson(currentTestFilePath, newData)).rejects.toThrow("Fallback replacement rename failed")
 
+		const backups = (await fs.readdir(tempDir)).filter((entry) => entry.includes(".bak_"))
+		expect(backups).toHaveLength(1)
+		expect(await readFileContent(path.join(tempDir, backups[0]))).toEqual(initialData)
+		await safeWriteJson(currentTestFilePath, newData, {
+			merge: (existing) => {
+				expect(existing).toEqual(initialData)
+				return newData
+			},
+		})
+
 		// Verify console.error was called for the rollback failure
 		expect(consoleErrorSpy).toHaveBeenCalledWith(
 			expect.stringContaining("Failed to restore backup"),
@@ -595,21 +605,20 @@ describe("safeWriteJson", () => {
 			const backupPath = path.join(tempDir, `.${path.basename(currentTestFilePath)}.bak_1_stale.tmp`)
 			await fs.writeFile(backupPath, JSON.stringify({ stale: true }))
 			// Directory access succeeds; only the canonical-path check fails.
-			vi.mocked(fs.access)
-				.mockResolvedValueOnce(undefined)
-				.mockRejectedValueOnce(Object.assign(new Error("Canonical access failed"), { code }))
+			const error = Object.assign(new Error("Canonical access failed"), { code })
+			vi.mocked(fs.access).mockResolvedValueOnce(undefined).mockRejectedValueOnce(error)
 			const merge = vi.fn((existing: unknown) => existing)
 
-			await safeWriteJson(currentTestFilePath, {}, { merge })
+			await expect(safeWriteJson(currentTestFilePath, {}, { merge })).rejects.toBe(error)
 
-			expect(merge).toHaveBeenCalledWith({ initial: "content" }, {})
+			expect(merge).not.toHaveBeenCalled()
 			expect(await readFileContent(currentTestFilePath)).toEqual({ initial: "content" })
-			expect(await fs.readdir(tempDir)).toEqual([path.basename(currentTestFilePath)])
+			expect(await readFileContent(backupPath)).toEqual({ stale: true })
 		},
 	)
 
 	it.each(["ENOENT", "EACCES", "EIO"])(
-		"should recover from a readable backup when another backup stat fails with %s",
+		"should preserve backups when another backup stat fails with %s",
 		async (code) => {
 			await fs.unlink(currentTestFilePath)
 			const unreadableBackup = path.join(tempDir, `.${path.basename(currentTestFilePath)}.bak_1_bad.tmp`)
@@ -625,14 +634,60 @@ describe("safeWriteJson", () => {
 			})
 			const merge = vi.fn((existing: unknown) => existing)
 
-			await safeWriteJson(currentTestFilePath, {}, { merge })
+			if (code === "ENOENT") {
+				await safeWriteJson(currentTestFilePath, {}, { merge })
+				expect(merge).toHaveBeenCalledWith({ committed: true }, {})
+			} else {
+				await expect(safeWriteJson(currentTestFilePath, {}, { merge })).rejects.toMatchObject({ code })
+				expect(merge).not.toHaveBeenCalled()
+				expect(await readFileContent(unreadableBackup)).toEqual({ stale: true })
+				expect(await readFileContent(readableBackup)).toEqual({ committed: true })
+			}
+		},
+	)
 
-			expect(merge).toHaveBeenCalledWith({ committed: true }, {})
-			expect(await readFileContent(currentTestFilePath)).toEqual({ committed: true })
-			expect(await fs.readdir(tempDir)).toEqual([path.basename(currentTestFilePath)])
+	it.each(["rename", "stat"] as const)(
+		"should abort recovery and preserve history when backup %s fails",
+		async (operation) => {
+			await fs.unlink(currentTestFilePath)
+			const backupPath = path.join(tempDir, `.${path.basename(currentTestFilePath)}.bak_1_saved.tmp`)
+			const committed = { history: ["saved"] }
+			await fs.writeFile(backupPath, JSON.stringify(committed))
+			const error = Object.assign(new Error("Recovery failed"), { code: "EACCES" })
+			vi.mocked(fs[operation]).mockRejectedValueOnce(error)
+			const merge = vi.fn()
+
+			await expect(safeWriteJson(currentTestFilePath, {}, { merge })).rejects.toBe(error)
+
+			expect(merge).not.toHaveBeenCalled()
+			expect(await readFileContent(backupPath)).toEqual(committed)
+			await expect(fs.readFile(currentTestFilePath)).rejects.toMatchObject({ code: "ENOENT" })
+			await safeWriteJson(currentTestFilePath, {}, { merge: (existing) => existing })
+			expect(await readFileContent(currentTestFilePath)).toEqual(committed)
 		},
 	)
 
+	test("should restore by mtime and preserve unrelated siblings", async () => {
+		await fs.unlink(currentTestFilePath)
+		const prefix = `.${path.basename(currentTestFilePath)}`
+		const newest = path.join(tempDir, `${prefix}.bak_1_newest.tmp`)
+		const older = path.join(tempDir, `${prefix}.bak_9_older.tmp`)
+		const unrelated = path.join(tempDir, ".other.json.bak_1_saved.tmp")
+		const wrongSuffix = path.join(tempDir, `${prefix}.bak_1_saved.txt`)
+		await fs.writeFile(newest, JSON.stringify({ newest: true }))
+		await fs.writeFile(older, JSON.stringify({ older: true }))
+		await fs.writeFile(unrelated, "keep")
+		await fs.writeFile(wrongSuffix, "keep")
+		await fs.utimes(older, new Date(1000), new Date(1000))
+		await fs.utimes(newest, new Date(2000), new Date(2000))
+
+		await safeWriteJson(currentTestFilePath, {}, { merge: (existing) => existing })
+
+		expect(await readFileContent(currentTestFilePath)).toEqual({ newest: true })
+		expect(await fs.readFile(unrelated, "utf8")).toBe("keep")
+		expect(await fs.readFile(wrongSuffix, "utf8")).toBe("keep")
+	})
+
 	test("should open the replacement with write access for flushing", async () => {
 		const open = vi.mocked(fs.open)
 		open.mockClear()
 
@@ -106,7 +106,11 @@ async function recoverInterruptedReplacement(
 	try {
 		await fs.access(absoluteFilePath)
 	} catch (error: unknown) {
-		canonicalPathMissing = typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT"
+		if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "ENOENT") {
+			// Unknown canonical state must not authorize deleting committed backups.
+			throw error
+		}
+		canonicalPathMissing = true
 	}
 
 	if (canonicalPathMissing) {
@@ -120,9 +124,19 @@ async function recoverInterruptedReplacement(
 					.map(async (backupPath) => {
 						try {
 							return { backupPath, mtimeMs: (await fs.stat(backupPath)).mtimeMs }
-						} catch {
-							// Skip leftovers removed or made unreadable since the directory listing.
-							return null
+						} catch (error: unknown) {
+							if (
+								typeof error === "object" &&
+								error !== null &&
+								"code" in error &&
+								error.code === "ENOENT"
+							) {
+								return null
+							}
+							// An unreadable backup could be the newest committed state.
+							// Intentionally block writes until it becomes readable or is
+							// explicitly removed, rather than risk losing committed history.
+							throw error
 						}
 					}),
 			)
@@ -138,6 +152,7 @@ async function recoverInterruptedReplacement(
 					`Failed to restore interrupted-write backup ${newestBackupPath} to ${absoluteFilePath}:`,
 					restoreError,
 				)
+				throw restoreError
 			}
 		}
 	}
@@ -322,17 +337,8 @@ async function safeWriteJson(filePath: string, data: unknown, options?: SafeWrit
 			}
 		}
 
-		// Cleanup the .bak file if it still needs to be (i.e., wasn't successfully restored)
-		if (actualTempBackupFilePath) {
-			try {
-				await fs.unlink(actualTempBackupFilePath)
-			} catch (cleanupError) {
-				console.error(
-					`[Catch] Failed to clean up temporary backup file ${actualTempBackupFilePath}:`,
-					cleanupError,
-				)
-			}
-		}
+		// A failed rollback leaves the backup as the only committed copy.
+		// Preserve it for recovery by a later writer.
 		throw originalError // This MUST be the error that rejects the promise.
 	} finally {
 		// Release the lock in the main finally block.