{"record":{"id":"0649d3f340d0cee3","repo":"astrid-runtime/astrid","slug":"failed-to-persist-e-0649d3","errorCode":null,"errorMessage":"failed to persist {}: {e}","messagePattern":"failed to persist (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/distro/trust.rs","lineNumber":117,"sourceCode":"    }\n    let mut tmp = tempfile::NamedTempFile::new_in(path.parent().unwrap_or(home.root()))\n        .context(\"failed to create temp file for trust pin\")?;\n    std::io::Write::write_all(&mut tmp, format!(\"{key_str}\\n\").as_bytes())\n        .context(\"failed to write trust pin staging\")?;\n    // Windows `rename` (which `persist` uses) won't overwrite an existing\n    // destination, so re-pinning (`--accept-new-key`) would fail there.\n    // Remove any existing pin first; a missing file is expected and fine.\n    match std::fs::remove_file(&path) {\n        Ok(()) => {},\n        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {},\n        Err(e) => {\n            return Err(e).with_context(|| {\n                format!(\"failed to replace existing trust pin {}\", path.display())\n            });\n        },\n    }\n    tmp.persist(&path)\n        .map_err(|e| anyhow::anyhow!(\"failed to persist {}: {e}\", path.display()))?;\n    Ok(())\n}\n\n/// Verify a sealed distro's signature and apply the trust policy.\n///\n/// `manifest_pubkey` is the `[distro.signing].pubkey` declared in the\n/// manifest. `sig_hex` is the `Distro.sig` contents. `lock` is the\n/// resolved lock the signature covers.\n///\n/// # Errors\n///\n/// - signature does not verify (no override),\n/// - key differs from the pin and `accept_new_key` is false,\n/// - no trust pin exists,\n/// - malformed key/signature.\npub(crate) fn verify_and_pin(\n    home: &AstridHome,\n    distro_id: &str,","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/distro/trust.rs#L99-L135","documentation":"write_pin writes the trusted distro public key into the Astrid home trust store atomically: it stages the pin in a NamedTempFile, removes any existing pin, then calls tempfile's persist() to rename it into place. This error means the final rename/replace failed (PersistError), so the trust pin was not applied even though the key itself may have been verified.","triggerScenarios":"verify_and_pin -> write_pin when persist(&path) fails: destination locked by another process (antivirus/indexer holding the file, especially on Windows rename semantics), permissions on the trust directory changed mid-write, target path re-created between remove_file and persist, disk full, or the Astrid home directory was made read-only.","commonSituations":"Running the CLI under a different user than the one owning ~/.astrid; syncing tools (Dropbox/OneDrive) locking trust files; corporate EDR/antivirus intercepting renames in the home directory; full disk while applying a distro.","solutions":["Check free disk space and retry the distro apply / pin command.","Fix permissions on the trust directory under the Astrid home (chown/chmod to the running user).","Close processes locking the target file (AV, sync clients) or add the Astrid home to exclusions.","Remove the existing pin file manually and re-run with --accept-new-key."],"exampleFix":"# before\n$ astrid distro apply my-distro --accept-new-key\nError: failed to persist /home/u/.astrid/trust/my-distro.key: ...\n# after\n$ chmod u+w ~/.astrid/trust && rm -f ~/.astrid/trust/my-distro.key\n$ astrid distro apply my-distro --accept-new-key","handlingStrategy":"try-catch","validationCode":"let trust_dir = path.parent().unwrap();\nif !trust_dir.exists() { std::fs::create_dir_all(trust_dir)?; }\nlet meta = std::fs::metadata(trust_dir)?;\nassert!(meta.permissions().readonly() == false, \"trust dir is read-only\");","typeGuard":null,"tryCatchPattern":"match verify_and_pin(...) {\n    Ok(outcome) => info!(\"pinned: {:?}\", outcome),\n    Err(e) if e.to_string().contains(\"failed to persist\") => {\n        eprintln!(\"could not write trust pin (disk/permissions/lock?): {e}\");\n    },\n    Err(e) => return Err(e),\n}","preventionTips":["Run astrid under a user that owns ~/.astrid.","Exclude the astrid home directory from AV and file-sync tools.","Keep free disk headroom on the home volume.","Prefer native filesystems over network mounts for the astrid home."],"tags":["filesystem","atomic-write","persist","trust-store"],"backgroundTag":"file-write-failed","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}