Function migrate_file_in_place 

pub fn migrate_file_in_place(
    path: &Path,
) -> Result<Option<MigrateReport>, Error>

File-API wrapper: read disk config, migrate, write <file>.backup adjacent to the original, then atomically replace the original. Returns Ok(None) when already current.

Backup file is <config_filename>.backup (joined cross-platform via Path ops). The write path mirrors Config::save() so the documented durability guarantee holds end-to-end:

1. Write the migrated content to <path>.tmp-<uuid> and fsync it.
2. Copy the original to <path>.backup (existing behavior; recovery rope if anything later goes wrong).
3. rename(<path>.tmp, <path>) — atomic on Unix and on modern Windows.
4. Fsync the parent directory so the rename is durable.

On rename failure the temp file is removed and the backup is restored over the original so the operator never observes a partial write.