Teach ln -f to leave original target alone if link creation fails. Suggested by Ashwini Sharma, I wound up implementing it by creating the new link at a temporary name and renaming it over the old one instead of renaming the old file out of the way and putting it back if it failed. (Because "mkdir -p one/one/blah && ln -sf /bin/one one" would otherwise rename one/one out of the way and only notice it can't delete it way at the end when recovery's darn awkward, vs create new thing and if rename fails (including EISDIR) that's the main error path. And yes the temporary name is in the same directory as the destination so we never rename between mounts.) link over the old one instead of renaming the old file and renaming it back.

/* link.c - hardlink a file
 *
 * Copyright 2011 Rob Landley <rob@landley.net>
 *
 * See http://opengroup.org/onlinepubs/9699919799/utilities/link.html

USE_LINK(NEWTOY(link, "<2>2", TOYFLAG_USR|TOYFLAG_BIN))

config LINK
  bool "link"
  default y
  help
    usage: link FILE NEWLINK

    Create hardlink to a file.
*/

#include "toys.h"

void link_main(void)
{
  if (link(toys.optargs[0], toys.optargs[1]))
    perror_exit("couldn't link '%s' to '%s'", toys.optargs[1],
      toys.optargs[0]);
}