Deferred minors from the review of fix/oauth-atomic-writes-perms (merged for v0.0.239).
- Rename-into-place replaces a symlinked target instead of writing through it.
credential_store.replaceFile on a settings.json -> real.json symlink replaces the symlink with a regular file, leaving real.json stale. Decide the policy (resolve symlinks before staging, or document replacement) — today it is silent.
keys_cli.zig conversion is untested on its live platforms. The file path is dead on macOS (storeKey short-circuits to the keychain), so the atomic conversion there runs only on Linux/Windows where we have no local coverage. Also the comment overstates 0600 on Windows: private_file degrades to .default_file and the chmod block is comptime-elided (has_executable_bit == false).- Directory fsync (power-loss durability).
replaceFile fsyncs the temp file but not the containing directory, so the rename itself is not durable across power loss (fine across process crashes). Matches the pre-existing in-tree pattern (learn_store, eval_memory); qualify or harden as a batch if it ever matters.
Deferred minors from the review of fix/oauth-atomic-writes-perms (merged for v0.0.239).
credential_store.replaceFileon asettings.json -> real.jsonsymlink replaces the symlink with a regular file, leavingreal.jsonstale. Decide the policy (resolve symlinks before staging, or document replacement) — today it is silent.keys_cli.zigconversion is untested on its live platforms. The file path is dead on macOS (storeKeyshort-circuits to the keychain), so the atomic conversion there runs only on Linux/Windows where we have no local coverage. Also the comment overstates 0600 on Windows:private_filedegrades to.default_fileand the chmod block is comptime-elided (has_executable_bit == false).replaceFilefsyncs the temp file but not the containing directory, so the rename itself is not durable across power loss (fine across process crashes). Matches the pre-existing in-tree pattern (learn_store, eval_memory); qualify or harden as a batch if it ever matters.