Hardens apply_patch, source writes, and symbol diffs against lost metadata, ambiguous matches, and mislabeled overloads.
apply_patch now rejects malformed envelopes before any write: content outside Begin/End, invalid operation headers, empty move destinations, updates without an @@ hunk, and unprefixed payload lines fail with the offending line number. Non-exact matches (trailing whitespace, trim, indent, Unicode folding) must be unique in the eligible range; an ambiguous match refuses the hunk instead of editing the first hit or falling through to a looser tier.
Edits, syntax rollbacks, and hashline transactions write through one safe writer. A synced sibling temp file replaces the target only when the replacement provably keeps the original's owner, group, mode, ACLs, extended attributes, and hard links; on Windows the temp receives the file's own DACL, protected from inheritance and read back byte-for-byte, before any content is written. Otherwise the file is rewritten in place, but only after its original bytes are saved to a recovery copy that is restored if the write fails, so a failed write never truncates the original. Recovery copies share one lookup identifier — the readable name when short UTF-8, else a hash of the name's bytes — so a leftover copy is always found and reported. On Unix the original mode is restored after an in-place write to keep set-id bits; on Windows single-link files go through ReplaceFileW, which keeps the security descriptor and attributes, with hard-linked files falling back in place. Writer warnings reach edit replies, the apply_patch reply (including hunks a syntax check rolls back), and hashline outcomes.
Symbol diffs keep every overload sharing an identity, pair changed declarations whose signature still exists first, and match the remainder by position, so editing one overload no longer collapses into the first declaration of that name.
Refactors
Line offsets are computed once per batch; trimmed, Unicode, and reflow matching compare in place without allocating normalized copies.
Git blobs for a range are read through one shared git cat-file --batch process with a per-blob fallback; scanner buffers are released on finalization and syntax checks reuse a worker-local parser.
Drift-guard tests register the new buffer-truncation and Option::take sites in edit.rs; the Windows DACL test now runs in a folder granting Everyone inheritable read, so an inherited temporary carries an entry the restricted file does not and a copied DACL stays distinguishable.
Confidence Score: 5/5
The changes since the previous review appear safe to merge.
Summary
The PR hardens source writes, patch parsing and matching, and symbol diffs.
File edits keep their access details and can recover old bytes after a failed write.
Patch application rejects malformed input and ambiguous inexact matches.
Symbol diffs track overloaded declarations as separate entries.
Batch edits reuse line offsets, and finished scans release their source buffers.
No new actionable issues were found in that change. Windows tests were not run on this Linux host. All supplied previous threads were unnumbered and remain review context.
