[kridaydave]

Bugs

• UPDATE-04: deletes run before the untracked-overwrite check so a bail leaves a half-mutated tree
• UPDATE-07: the overwrite check is silently skipped when its read fails, then rename fails obscurely over a directory

What was wrong

• src/update.rs:195,256 (straight path) and src/update.rs:421,525 (merge path): the code deleted tracked files first, then checked whether target writes would overwrite an untracked path. A bail at that check left deletions applied and writes undone, with no rollback.
• src/update.rs:258,525: the untracked-overwrite guard used if let Ok(existing_bytes) = std::fs::read(&full), so read failures (directory, permission, dangling-target cases) skipped the bail. write_file_atomic then failed later (for example, renaming over a directory) after deletes had already run.

Fix

• Added check_untracked_overwrite and validate_untracked_writes helpers. They inspect existing paths with symlink_metadata, bail with a clear message for directories, propagate read/inspect errors with context, and compare bytes before allowing an overwrite.
• Straight path (run): validate all untracked snapshot writes before any delete when not --force.
• Merge path (materialize_merge): validate untracked collisions for paths that will be written before any delete.
• Kept the change minimal and updated the nearby comment to describe the check/apply ordering.

Verification

CI green (fmt, clippy, tests, release build, adjudication) + regression tests test_update_untracked_collision_does_not_delete_before_bail, test_update_untracked_symlink_collision_does_not_delete_before_bail, and test_update_merge_untracked_collision_does_not_delete_before_bail in tests/update_test.rs.