single-writer-bulk-rewrites

To prevent data integrity issues during bulk vault rewrites, route all batch updates through a validated single-file writer that enforces rename-before-commit invariants and per-file write isolation across the collection.

The safest way to execute large-scale vault rewrites is wrapping the batch with collection-wide gating checks, including serve-owner refusal and dry-run accounting, while delegating writes to the single-file writer.

Bulk vault rewrites violate rename-before-commit invariants because uncoordinated multi-file updates cause partial commits and inconsistencies, bypassing the atomicity and ownership gating enforced by the single-file writer.

Running batch vault updates without per-file write isolation risks breaking rename-before-commit invariants. Failing to route writes through the single-file writer removes collection-wide safety gates and risks partial updates.

Yes, you need to call the existing single-file writer for each file in the batch. This routing mechanism preserves per-file write isolation and enforces collection-wide gating checks during the operation.