Function rename_sop_typed 

pub fn rename_sop_typed(
    sops_dir: &Path,
    from: &str,
    to: &str,
    default_execution_mode: SopExecutionMode,
) -> Result<(), SopAuthorError>

Rename an existing SOP: move <sops_dir>/<from>/ to <sops_dir>/<to>/ and update the manifest’s [sop] name so the directory and the name the runtime loads stay in agreement.

Rename is a pure identity change. Only the [sop] name value in SOP.toml is rewritten, keeping that line’s own comment and spacing; steps, triggers, key order, and every other manifest key are left alone, and SOP.md is never touched. That keeps a rename from quietly materializing defaults (an execution mode the manifest deliberately left unset, say) the way a load/save round trip would. The one cosmetic change is quote style: a single-quoted name comes back double-quoted.

One writer at a time. A concurrent save_sop, create_sop_typed, or second rename against the same SOP can interleave with the steps below; the authoring surfaces are a single daemon, and nothing here adds cross-process locking.

Ordering is what makes this safe against an interrupted rename. The directory move is a single rename(2), and it goes last:

1. collision-check to and strict-validate the renamed SOP, before anything on disk moves;
2. rewrite [sop] name in place, via a temp file renamed over the manifest, so SOP.toml is never half-written;
3. move the directory - the commit point.

The SOP therefore lives in exactly one directory at every instant: there is no window with two copies (a fork) or zero copies (a loss). An interruption between steps 2 and 3 leaves one directory whose name lags its manifest; re-running the same rename finishes the job. If step 3 fails outright the manifest is rolled back, leaving the SOP exactly as it was found.

Each step commits through a rename, so a reader and a process killed mid-rename both see one whole revision. The directory holding each renamed entry is flushed afterwards, so on Unix the two steps are durable across a machine crash in the same order they were applied: an interrupted rename leaves the SOP either wholly moved or wholly not, never both places or neither. macOS honors the flush for ordering without draining the device cache, and Windows has no directory-sync primitive, so on those platforms that last step is the filesystem’s to keep.

Errors: NotFound if from is not an SOP directory, AlreadyExists if anything already occupies to, and Other for an invalid name (the same single-path-component check every other authoring helper applies), a SOP that strict validation rejects, or an I/O failure.