Make single backup copy of confluence.cfg.xml immediately before any writes to it by the application. Application should be able to restore from backed up copy if it gets corrupted.

It would be great if Confluence would do the following to better recover when confluence.cfg.xml is corrupted by the application (as appears to happen when the application process is killed, etc.):

• Immediately before confluence writes to confluence.cfg.xml, it could copy confluence.cfg.xml to confluence.cfg.lastgood (that is just an example name- may want to come up with something better)

• If confluence starts up and confluence.cfg.xml is empty or unreadable, it attempts to copy confluence.cfg.lastgood to confluence.cfg.xml, and then loads confluence.cfg.xml

This is not the same as the existing request in http://jira.atlassian.com/browse/CONF-8435 because I'm not suggesting that the confluence.cfg.xml have any more than one backup of the last successfully loaded config. This is the way that weblogic servers handle configuration files (at least in 8.1.5 that's how it was done) and it seems to work well and be very useful (I think the extension they use is "boot", but I don't think that would be appropriate in this case).

IMO, this would make Confluence much more robust.