> This can't be fixed by fsck, because having both link isn't an
> inconsistency. It just violates the expectation that renames are atomic.

What expectation?  Is this in POSIX?  If so, I might be missing it.

The man page for rename(2) guarantees there will always be at least
one link to the file even if a crash occurs during the rename()
operation.  It does not guarantee there will be exactly one link. :)

Cheers,
Rob