Invariant
No requested setting is successful until its persisted representation, runtime reload, and effective state are verified. No failed transaction may leave an unreported partial state.
Transaction
- Resolve targets and acquire advisory scope locks.
- Re-read and compare fingerprints.
- Validate a complete plan and rollback plan.
- Persist a prepared journal record and exact-byte snapshots.
- Stage same-directory files, preserve metadata, write and fsync.
- Rename replacements and fsync parent directories.
- Reload the affected runtime and verify effective state.
- Commit history, or restore every target and verify rollback.
Ownership
Helm prefers explicit owned fragments. Otherwise it performs a lossless targeted edit and aborts if comments, ordering, unknown syntax, permissions, or safe path identity cannot be preserved. External edits are never overwritten. User-owned safe symlinks remain symlinks; magic links, path escapes, ownership changes, special files, and ambiguous hard links are refused.
Recovery and privacy
Startup completes any interrupted rollback before accepting new work. Helm keeps at least 100 transactions and all history from the last 90 days; pinned checkpoints do not expire. State is private to the user. Logs exclude configuration values, raw command output, environment variables, and full paths. Diagnostics are explicit, redacted exports.