- always save vault to tmp, then validate it and copy if ok