[cadence 77d6f0c7452b5617] The final staging move can overwrite a conflicting binary created after the existence check. #247

Raised at install.sh:186 as high by openai, ruled downgraded.

Claim. The final staging move can overwrite a conflicting binary created after the existence check.

Failure scenario. Two installers download different development builds bearing the same version and both observe that staged is absent. Installer A publishes its verified binary. Installer B then executes mv -f and silently replaces A's binary, bypassing the checksum-conflict refusal that would have applied had B checked afterward. Publication needs an atomic no-replace operation followed by validation of any existing destination.

Filed by Cadence. Fingerprint 77d6f0c7452b5617 over (file, claim).