What
A second implementation of the global config writer was added that goes through the storage backend, with stronger corruption handling. Which one runs depends on whether that backend is available, and the build does not settle that at any single point.
Details
- It takes a rate-limited rotating backup keeping 5 copies, re-reads and merges under a lock, and refuses any write that would drop cached auth credentials.
- On a parse error it auto-repairs from the cached snapshot, and backs up the corrupted file through the backend, skipping the copy when identical content was already saved.
- Existing telemetry (
tengu_config_auth_loss_prevented,tengu_config_stale_write) is unchanged.
Evidence
The corrupted file has already been backed up.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.