v2.3.0 — flattener write-path hardening
The disk write path is now safe against power loss and concurrent writers, not just process crashes (#13):
- fsync around both atomic renames — a power cut can no longer tear the session file or its backup, or lose the rename itself (F_FULLFSYNC on macOS).
- Pre-rename staleness check — if a live session appends lines while a flatten or unflatten is running, the operation aborts with a retry message instead of silently discarding them; the opt-in
count_tokenscall now runs after the writes, outside that window. - Stale temp sweep —
.tmp-<pid>files stranded by crashed writers are cleaned up after 15 minutes. - Backup integrity gate — a flatten is refused outright when any marker in the rewritten session would not resolve in the rebuilt backup, so a torn or missing backup is surfaced loudly instead of compounded.
No API or tool-surface changes. Full details: CHANGELOG | PR #37