Failed move rewrites backlinks before rejecting the destination, leaving broken links #230

Moving a note to a destination whose parent is a regular file returns an error after rewriting its backlinks. The target stays at its original path, but the authored Markdown now points to a nonexistent destination. Reindexing cannot repair this: it faithfully projects the already changed source files.

Reproduced on commit 1776e030eee3343652e6392f0233598fab52160c using the current source via cargo run, with the deterministic fake embedder and an isolated temporary vault.

Reproduction

1. Create a vault containing a.md with Target note., b.md with See [[a]]., and a regular file named blocked.
2. Run B2_EMBEDDER=fake cargo run --quiet -p b2-cli -- -C <vault> reindex.
3. Run B2_EMBEDDER=fake cargo run --quiet -p b2-cli -- -C <vault> mv a.md blocked/a.md.

Observed:

• The move exits 1 with the generic failure message.
• a.md still exists at its original path.
• b.md now contains See [[blocked/a]]..
• The requested destination does not exist.

Expected: a rejected move leaves the original note and every inbound file byte-identical, with the original links resolving.

Cause and scope

move_note calls rewrite_inbound before rename_with_parents. The shared rewrite_inbound reads and writes inbound files sequentially with immediate error propagation and no rollback. A destination-parent failure therefore occurs after authored content has changed; a failure on a later inbound file can also leave earlier rewrites applied.

Resource and directory moves use the same helper and should be covered by the fix; the reproduction above exercises the note arm only. Both CLI and desktop inherit the core behavior.

This contradicts index-engine.md §8: the rewrite is described as transactional, with no partially updated vault. The disposable-index guarantee cannot recover lost original link text.

Acceptance criteria

• Add a deterministic, model-free regression test for the destination-parent failure above before changing implementation; assert original file bytes, paths, and resolved links.
• Exercise a failure after at least one inbound rewrite and ensure the operation restores original authored content, rather than returning an error with partial changes left behind.
• Apply the failure-handling contract consistently to note, resource, and directory moves, preserving aliases and unrelated bytes.
• Validate destinations before writing, but do not rely on preflight alone: later I/O failures still require handling.
• Explicitly reconcile the documented transaction guarantee with the implemented behavior for ordinary I/O failures and interrupted operations. A SQLite transaction alone does not roll back filesystem writes.
• Run the existing move/projection suites and make check; run make ci before pushing the fix.