Stage reconcile restore copies so a failed rollback cannot wipe the workspace

[cursor]

Problem

restore_workspace cleared the live workspace with clear_dir_contents before copy_tree from the snapshot. copy_tree is not atomic: an unreadable snapshot file, disk-full, or I/O error after the clear left the tree empty or partial while restore returned false.

run_reconcile's finish_fail only sets rolled_back=true when restore succeeds, so callers could see status=failed (not rolled_back) after the original files were already gone. rollback_on_failure is supposed to put the pre-run tree back, not wipe it.

Fix

Copy the snapshot into .arbiter-reconcile-snapshots/.restore-staging first (that directory is already skipped by clear_dir_contents, same as pre). Only after that copy succeeds do we clear the live tree and install the staged files. A failed stage leaves the original files in place. A failed install into the live tree leaves staging on disk so the copy is still recoverable.

Tests

unit_reconcile:

• Unreadable snapshot file: restore returns false and keep.txt is still the original bytes.
• Readable snapshot: live extras are dropped and snapshot contents are installed; staging is cleaned up.

Suite 21/21 locally (73 assertions) + ASan + UBSan.

Independently mergeable against main (0456350). Does not touch files owned by #321–#355 except CHANGELOG [Unreleased], which sibling-conflicts after the first of those merges, same as the rest of the series.

  

---

Note

Medium Risk
Changes reconcile rollback I/O ordering on failure paths; behavior is safer but any bug in staging/clear could still affect workspace contents during rollback_on_failure.

Overview
Reconcile rollback no longer empties the workspace when restore_workspace fails mid-copy. The snapshot is copied into .arbiter-reconcile-snapshots/.restore-staging first (skipped by clear_dir_contents, same as the pre snapshot). Only after a successful stage does the live tree get cleared and replaced from staging; a failed stage leaves original files untouched. If install into the workspace root fails, staging is left on disk for manual recovery.

include/reconcile.h documents this contract. CHANGELOG [Unreleased] records the fix. Tests cover unreadable snapshot files (restore returns false, keep.txt unchanged) and a happy-path restore (extras removed, staging cleaned up).

^{Reviewed by Cursor Bugbot for commit 5680aa8. Bugbot is set up for automated code reviews on this repo. Configure here.}