fix: write persistence files atomically

[danReynolds]

Summary

FileDataStoreConfig persisted both data stores and the resolver index with file.writeAsString, which opens with FileMode.write — truncating the target to zero before writing the new contents. That leaves a window where a crash, OOM kill, or power loss corrupts the file:

[complete old JSON] → [empty] → [partial new JSON] → [complete new JSON]

On the next launch jsonDecode throws (and only PathNotFoundException is caught), so the error propagates through Loon.hydrate and that partition's data is lost or startup breaks. This affects the default persistor on mobile/desktop, and the resolver file is equally exposed (it's the path → store-name index).

Fix

Write to a sibling temp file, flush it to disk, then rename over the target:

write users.json.tmp → flush → rename(users.json.tmp → users.json)

A same-filesystem rename is atomic, so the target always holds either the complete previous contents or the complete new contents — never a torn file. The flush before the rename ensures the data is durable so the rename can't expose an empty file after power loss.

Why this is safe cross-platform

Modern Dart (3.x, which the package requires) documents that File.rename removes an existing destination file first, and on Windows it uses MoveFileEx-style replace semantics for regular files (our case — these are plain .json files, not symlinks). So no platform special-casing is needed.

Orphaned temp files are harmless

The worker's data store file listing (fileRegex) matches only …\.json$, so a users.json.tmp orphaned by an interrupted write is not loaded as a store — it's simply overwritten on the next write. A test pins this.

Scope / what this does not cover

This makes each file individually torn-proof. It does not make a multi-file sync (multiple partitions + resolver) transactionally consistent — that would need a manifest/generation pointer and is out of scope. For static persistence keys the resolver rarely changes, so this fix covers the real, common failure (a torn individual file on a process kill). SQLite/IndexedDB backends are already transactional and are unaffected.

Test plan

• flutter test test/native --concurrency=1 — 86/86 green (the existing 42 round-trip persistor tests confirm the atomic write produces identical content)
• New: asserts no .tmp files remain after a sync
• New: asserts the data store listing ignores orphaned .tmp files
• flutter analyze clean on changed files

---

Generated by Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.