Apply configuration secrets atomically

docs/config.md

@@ -76,8 +76,10 @@ The prompt-facing location timezone is derived from the effective
 ### `secrets`
 
 `secrets.directory` defaults to empty, which disables secret loading. When it
-is set, every regular file directly in that directory is loaded after the file
-and command-line overrides. A file basename must match
+is set, every regular file directly in that directory is staged after the file
+and command-line overrides, then applied only after the complete configuration
+has validated successfully. A rejected load leaves the existing environment
+unchanged. A file basename must match
 `[A-Za-z_][A-Za-z0-9_]*`; it becomes an environment variable name, and the
 file contents replace any existing value. One trailing LF or CRLF is removed.