[Code0x58]

Requires Python 3.9+ consistently across package metadata, documentation, and CI. License metadata uses SPDX, with a compatible build backend and no redundant wheel build dependency.

CI builds the wheel and source distribution once, validates metadata strictly, and tests installations outside the checkout across CPython 3.9–3.15 and PyPy 3.11 on Linux, plus CPython on Windows. The release workflow runs the same validation before publishing the exact tested artifacts. Only the separate pypi environment job receives publishing identity permissions; the existing publish.yml Trusted Publisher identity is retained.

Actions use current releases pinned to immutable commit SHAs, with weekly Dependabot updates. Codecov credentials are restricted to upload steps in a separate reporting job. Coverage and JUnit reports from both Linux and Windows are uploaded together so platform-specific behavior is counted. Reporting also runs after failed tests when reports are available.

Validation: actionlint, strict Twine checks, and local artifact installation tests on CPython 3.9/3.15 and PyPy 3.11. Hosted CI passes the build, all 15 interpreter/OS combinations, and report uploads.

This PR covers review findings 7 and 8.

Merge order for this stack:

1. Modernize CI and validate distributions before publishing #14 — CI/CD, packaging, and compatibility claims (findings 7–8)
2. Repair assertions and isolate test files #15 — Repair assertions and isolate test files (finding 10)
3. Persist deletions when automatic commits are enabled #16 — Persist deletions when automatic commits are enabled (finding 1)
4. Use unique temporary files for atomic saves #17 — Use unique temporary files for atomic saves (finding 5)
5. Preserve file permissions during atomic replacement #18 — Preserve file permissions during atomic replacement (finding 2)
6. Restore transaction state when committing fails #19 — Restore transaction state when committing fails (finding 6)
7. Fix README examples and clarify transaction guarantees #20 — Fix README examples and clarify transaction guarantees (finding 9)
8. Reject unsupported values before changing store data #21 — Reject unsupported values before changing store data (finding 3)
9. Accept shared containers while rejecting reference cycles #22 — Accept shared containers while rejecting reference cycles (finding 4)

Each PR targets its predecessor. Value validation and cycle detection are last. Merge in order; if squash-merging, rebase and retarget the remaining stack as each parent lands.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.83%. Comparing base (868186a) to head (9b8e1c4).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #14   +/-   ##
=======================================
  Coverage   95.83%   95.83%           
=======================================
  Files           1        1           
  Lines         144      144           
=======================================
  Hits          138      138           
  Misses          6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.