docs(notes): ranked ledger of 15 verified data-safety defects in the transfer engines

[vdavid]

What this is

A report, not a fix. docs/notes/adversarial-data-safety-hunt-2026-09-01.md is a ranked triage list of data-safety defects in write_operations/transfer/ (both engines) and the write_operations/ umbrella, from an adversarial hunt: one reading agent per subsystem, instructed to read every non-test file in full and to look for the guard before reporting anything. Every finding was then verified by following the cited file:line paths in the code, so "confirmed" means the mechanism holds at 5fdc323.

Scope, honestly

The plan was 18 subsystems. The run was stopped for budget after four hunters returned (transfer core, the copy and move halves of the cross-volume engine, and the write-ops umbrella). 19 raw findings collapsed to 15 distinct ones; three were reported independently by two hunters. The note lists the 14 subsystems never reached (archive edits, delete/trash/clipboard, cmdr-fs, SMB, SFTP, MTP, operation log, secrets and settings persistence, file viewer, four slices of cmdr-index, git/downloads/listing), in the order a second run should take them.

The seven highs, all silent

#	Finding	Where
1	Cross-FS move Phase 4 remove_dir_alls the live source tree, destroying anything written into it after the scan	move_op/cross_fs.rs delete_sources_after_move
2	Deep merge keys the destination by exact byte name, so a case- or NFC/NFD-differing dest file is replaced under Skip/Stop (land deletes on AlreadyExists)	volume/merge.rs + staged_write.rs::land
3	Same-FS merge follows a directory symlink (Path::is_dir) and renames the link target's contents out of a folder the user never selected	move_op/mod.rs::merge_move_directory
4	Same-volume rename-merge does the same on a dir-vs-dir hit because the listing reports a dir symlink as is_directory	volume/rename_merge.rs
5	Upfront "Overwrite all smaller/older" compares a file against a directory's own inode size/mtime, yields Overwrite, and deletes the whole folder	conflict.rs::reduce_conditional_resolution
6	Local copy auto-rollback on a mid-batch error removes destination files that already replaced the user's originals: neither copy is left	copy/mod.rs PostLoopIntent::Failed
7	reap_stale_transfer_temps deletes by name and age, so it destroys the .cmdr-tmp-* that is the only copy of new data after a finalize_safe_replace failure	volume/cleanup.rs

Plus one high rated plausible (a Skip while staging two same-named sources is never recorded, so Phase 4 deletes an unlanded original), one high with a transient-failure precondition (any get_metadata error on the destination is read as "no conflict"), five mediums, and one low. Each entry carries the mechanism in call order, a user-level trigger, the guard that was ruled out, and a suggested fix.

Review notes

• The README bullet goes under "Load-bearing as the input to a job that hasn't been done yet".
• Checks run: docs-reachable, docs-dead-links, docs-link-text, resident-doc-budget, claude-md-details-sibling, oxfmt. All green.
• The commit carries the harness's Co-Authored-By trailer, which AGENTS.md says not to use; the session-level attribution rule overrode it. Strip it on landing if you prefer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YGbM7hYU8m9Wc37a4Xv6Yi

---

Generated by Claude Code

[vdavid]

Merged into local main as e8406f4af (rebased, so the hash differs). One change on the way in: the ranked list was a four-column table whose prose column ran to 134 chars and tripped table-hygiene, so it's a numbered list now. Content is unchanged. Closing and deleting the branch.