fix: data safety from the code review (paste into itself, Ctrl+S mid-switch, atomic saves), 0.117.2

[Maxaubert]

Data-safety fixes from the 2026-10-16 code review (research/prism/2026-10-16-code-review.md, findings #1, 2, 15, 18, 19, 8, 30). Built by an Opus agent and reviewed by a second.

Fixes

• Folder navigation scope: media / documents grouping #1 Paste a folder into itself: refused (counted as failed), for both copy and cut. It used to copy itself into itself level after level. copyCounted now lists before it creates the target. (pasteCopy.ts)
• Folder navigation scope: media / documents / per file type #2 Ctrl+S during a file switch: save() only writes when the editor is showing that path, and writes to the path its saved state belongs to. It used to write the previous file's text over the new file. The same guard keeps typing in the still-shown old document from being filed under the next file. (codeSave.ts, CodeView.tsx)
• Visualizer draw loop runs at full refresh while paused or invisible #15 Typing during a save: stays dirty. A save that finishes after you have moved on never touches the new file's editor state.
• HEIC decode worker process stays resident forever after one decode #18 Encoding and line endings: a renamed or moved file keeps its encoding and line endings. An unremembered file is sniffed on disk instead of being assumed UTF-8 with LF. (textFile.ts)
• file:text returns an un-awaited readFile promise, so read errors escape the catch #19 Saves are whole or not at all:
  • The editor writes a temporary file beside the target and renames it over, so a failed write (disk full) leaves the original intact.
  • It follows symlinks.
  • When Windows refuses the swap (EPERM, EACCES, EBUSY), it falls back to the old in-place write. (replaceFile.ts)
• First-run setup, and one way to compute a style #8, fsmedia protocol does not enforce the session-root wall #30 Rename and delete: never start paused media, and never pull the viewer back to a file you already left.

Behaviour changes to know:

• Deleting the film that is playing now moves to the next file paused; before, the next one played.
• The tmp-and-rename save drops a file's hidden/system attributes, alternate data streams (Zone.Identifier) and hard links, as every atomic save on Windows does. The ACL is inherited from the folder.

Tests

• New unit tests: pasteCopy.test.ts, codeSave.test.ts, textFile.test.ts, replaceFile.test.ts, useFileOps.test.ts. 258 files pass; typecheck clean, lint 0 errors.
• Full e2e: 126 of 128 passed. themeWall (frame timing) and zipPreviewBack (both on the known-flaky list) passed on an immediate rerun.

0.117.2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DzqPzR6LuAvhiDabNwqzpx