Module persistence 

Transactional persistence, atomic writes, and secret redaction for the v0.8.67 constitution-first setup lane (#3410).

This is the safety layer under every setup step. A setup session may touch several files (the setup-state sidecar, the user-global constitution, and — through the existing comment-preserving ConfigStore — config.toml). The contract this module guarantees:

• Preview writes nothing. SetupTransaction::preview reports what would change without touching the filesystem.
• Cancel leaves files unchanged. A staged transaction that is dropped without SetupTransaction::commit never wrote anything.
• Save is atomic. Each file is written through a temp file + rename (atomic_write); a multi-file commit either fully applies or fully rolls back, so a partial failure never leaves a half-written file.
• Secrets never leak. redact_secrets masks secret-bearing values for any report, log line, or diagnostic that might echo config text.

This module deliberately owns only the write / rollback / secret contract. Each setup step owns which fields it writes; see crate::setup_state and crate::user_constitution.

Structs

SetupTransaction

A staged multi-file write that either fully applies or fully rolls back.

Constants

REDACTED

The placeholder substituted for any redacted secret value.

Functions

atomic_write

Atomically write bytes to path via a sibling temp file + rename.

atomic_write_json

Atomically write value as pretty-printed JSON to path.

redact_json_secrets

Return a copy of a JSON value with secret-bearing data removed.

redact_secrets

Redact secret-bearing values from arbitrary text so it is safe to put in a setup report, log line, error message, or test snapshot.