Each file is written whole to a scratch path beside it, synced, and renamed into place, with the directory synced after; meta.json is renamed last, so its presence means the pair beside it is complete. A crash mid-write no longer leaves an empty cert.pem beside a valid meta.json, which failed every boot. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Change-Id: Iba003352383d86593545df17c62600694743611c