Module edit 

ign edit core — the Editor seam, the private edit tree, and the edit pipeline (13-05).

Three pieces live here:

• Editor / TokioEditor — the swappable editor seam. The real impl resolves VISUAL → EDITOR (trimmed; empty string = unset; no platform fallback — open -t -W semantics vary, so a missing editor refuses with a clear “set $EDITOR” message) and spawns it with an ARG VECTOR (<editor> <flags...> <target>, the target path appended LAST) — never a shell string (the lint.rs delegation precedent; injection-safe by construction). The child’s exit status is ADVISORY (Pitfall E1: vscode/emacs fork or daemonize, IDE shims linger) — whether an edit happened is decided by CONTENT, never by exit code.
• EditTempDir — one private (0700 on unix), unique-per-call directory per invocation with Drop-guard cleanup; [keep] (EditTempDir::keep) consumes it WITHOUT deleting — the fail-closed recovery path keeps the user’s edit on disk.
• edit_pipeline / StagedEdit — the pipeline itself (fetch → decode → edit → content-decided no-op/encode → staleness gate → staged push payload), documented at the function.

Editor resolution order and the arg-vector contract are planner-locked: VISUAL beats EDITOR; IDE-style editors ride inside the variable itself (EDITOR="code --wait" splits to the right argv with the target last). The CLI documents this (13-08).

Structs

EditTempDir

One private edit tree per ign edit invocation: a tempfile::TempDir created with 0700 permissions on unix (unique per call), removed by its Drop guard — and EditTempDir::keep consumes it WITHOUT deleting, the fail-closed recovery path that leaves the user’s edit on disk with its path printed in the error.

StagedEdit

The pipeline’s terminal product: the staged edit the CALLER (the 13-08 CLI, via the guard ladder) decides what to do with. Push is deliberately OUT of core’s signature — the pipeline ENDS at the staged payload, keeping gate composition at the dispatch layer (the 10-04 preview_then_confirm lesson: one gate site). import_zip is None EXACTLY when status is NoOp — there are no bytes to push, so the caller cannot push.

TokioEditor

The real editor: resolve VISUAL → EDITOR from the process environment and spawn it via tokio::process::Command with an arg vector.

Enums

EditStatus

The pipeline verdict. NoOp means the editor changed NOTHING — decided by CONTENT (byte-identical re-encode), never by the editor’s exit code. Ready carries the member-level blast radius: changed lists every resource member the staged push would write (diff_members’ B-relative non-same paths, with the ORIGINAL export as A and the re-encode as B).

Traits

Editor

The editor seam: open one file path in the user’s editor.

Functions

edit_pipeline

ign edit’s core loop (SC-5’s mechanics), in order:

run_editor_argv

THE single spawn site: run program with flags plus path (appended last) through tokio::process::Command — ARG VECTOR only, never a shell string (lint.rs:113-121 precedent; injection-safe). A spawn failure is the usage-class refusal naming the editor. A non-zero exit is SUCCESS here — the exit status is advisory (Pitfall E1); whether anything changed is decided by content downstream.