I141: transaction.rs god-module — the final StagingTxn extraction is deliberately deferred

[Xof]

Migrated from ISSUES.md, which was retired in favour of GitHub issues. Original id I141, priority P3, from the 2026-06-22 deep review (docs/reviews/review-20260622-054729.md).

The text below is the triaged entry verbatim, including the corrections triage made to the original finding.

---

Where: src/transaction/ (the directory module split out of the former transaction.rs)

Problem: The 2026-06-22 review tagged transaction.rs (~2.6k prod lines) a god-module (filed DESIGN, verifier-adjusted to SMELL): every durability invariant (3-fsync ordering, I18 freemap window, BUG#2 atomic staging, R1 cursor accounting, watermark rollback) encoded as prose comments + cross-references rather than types/module boundaries, with test-only Cell flags on the production struct.

Disposition (decomposed, then deliberately stopped): Worked incrementally — a directory-module split by concern plus four extracted units: SlotPacker (R1 packing, #77), FreemapRecycle (structural recycle + persist/reclaim, #78), CommitProtocol (the 3-fsync sequence, #79), and a #[cfg(test)] FaultInjector (#76). All behavior-preserving (the existing suite is the oracle; FreemapRecycle additionally passed a 4-lens adversarial review). The planned final unit — StagingTxn (the BUG#2 atomic allocate_inner prepare/install) — was deliberately NOT extracted: the candidate-prepare/install vocabulary (handle_table_insert_candidate, membership_insert_candidate, membership_remove_candidate, abort_allocate_prepare, inject_membership_failure, insert_into_data_page) is shared across allocate_inner (staging.rs) AND update_inner/delete_inner (mutate.rs), so a context-based extraction cannot be contained to staging.rs — it would force the most delicate mutation paths + packing.rs through a mechanical wrapper change for little cohesion gain. staging.rs is already a focused, holdable-in-context concern file.

Future work (incremental only): if/when the staging paths are touched for a real reason, fold the shared vocabulary into a StagingTxn unit at that point. Do NOT re-trigger a standalone extraction from the SMELL alone — the engine passes every test; on a green, pre-production engine a below-bug structural finding is the lowest-value, highest-risk change (this whole decomposition was a large undertaking driven by one SMELL). The remaining transaction.rs SMELL items below the extraction (the test-only flags) are already addressed by the FaultInjector split.

---

On-disk encryption

Source: [encryption 2026-06-29] — deferred work captured while implementing the on-disk encryption feature (design at docs/specs/2026-06-29-on-disk-encryption-design.md).