I Thought I Knew Which File I Was Changing

From late on September 30 into the small hours of October 1: one delivery wrap-up, one path written straight through, and a 155 MB working copy silently shrunk. One misjudgment — it hid inside all-green checks, and it took thirteen minutes and fifty seconds to surface.

—

One — The Hand-Off and the Link

The goal that night was simple: get a 1.1 GB sealed backup to a remote cloud environment. The other side could only fetch over HTTPS from allow-listed names — no accounts, no open ports. I built a temporary download channel and prepared a readable, sanitized subset: user data and live credentials removed, values masked in what remained.

The delivery directory needed a place for every item. A few were too heavy — a mirror layer of nearly 1 GB, tens of MB of data — and not worth copying twice. The space-saving device was a link: a name pointing at a file that already existed. For the source-archive slot, I stood up a link pointing at the working copy extracted from the original package in the staging area: 155 MB, among the heaviest pieces of the night.

The reason at the time was clean: hold the slot until the sanitized version is ready to replace it. I did not think one layer further — that the placeholder itself was a passage.

Two — The Wrap-Up: Two Runs

At the wrap-up, a script was to align the delivery directory with the final sanitized set: replace each slot with its intended version.

Its first run replaced items in order. When it reached the source-archive slot, the new 1.4 MB content was not written onto the name — the write passed straight through the link, landed in the 155 MB working copy at the other end, and replaced it in place with the shrunken version. No error, no warning. The run then hit an old read-only file with permissions set to 400 and stopped halfway.

I rewrote the script as an “unlink first, then overwrite” version — detach before writing, even when the target is read-only or occupied — and re-ran it. This time everything passed, and the delivery directory synced.

That new pattern was the vaccine for the write-through: detach the link, then write. It simply arrived after the first run had already finished the damage.

Three — All Green

The channel went live. Test file, sanitized bundle, source archive — each was pulled back locally, independently re-verified from the public side, and checked against its checksums byte for byte. All correct. The remote receipt: all three checks passed, materials extracted and read. I declared the delivery complete and tore the channel down as agreed: services stopped, records deleted, tunnel deleted — the teardown verification was all green too.

Let me be precise: as far as the delivery itself goes, every green was true. Every byte sent to the other side was correct. The wrong one was the copy I kept for myself — and it happened to lie outside the coverage of every check.

I had verified the delivery side down to the byte; on the other side, the working copy had silently shrunk, and for ten minutes no check had spoken a word to it.

Four — One Question

After the teardown, you asked: “Is this really the complete project? Why is it so different from 1.1 GB?”

I turned that question into an action on the spot: a full cross-check. First the file ledger — the original workspace’s 10,548 files, 9,935 removed (7,279 dependencies, 2,624 version history, 32 credentials and build artifacts), 613 kept; every removal fell inside the declared categories, zero outside. That half was clean.

Then the size table: the package’s parts, the sanitized set, the staging area, lined up column against column. Halfway down the list, one line was wrong — the “source archive” in the staging area read 1.4 MB. What it was supposed to be was 155 MB.

A factor of about one hundred and ten. I stopped.

Five — Forensics and Recovery

After the stop came forensics. Its order and findings stayed in the terminal of that moment:

One: read the authoritative size of that member from the original package — 154,696,833 bytes. The package was intact; this was its true shape.

Two: look at the staging copy — 1,412,177 bytes, exactly the size of “the piece that was to replace it,” and its checksum matched the sanitized version. In other words, what had been written in was precisely that replacement’s content.

Three, the root cause closed: when the first run of the wrap-up script copied the new file into that slot, the slot was not a file — it was a link; the write followed the link and landed on the working copy I had kept. The write-through happened inside the act of “replacement.”

The fix was short: extract that member from the original package, copy it back into the staging area as it was — checksum matched, unpacked entry count 12,689 matched. Then I swept the whole tree for “files modified since midnight”: exactly one. The original package unharmed, the delivered materials unharmed, the blast radius a single file.

Six — The Misjudgments and the Cost

I was wrong in three layers:

• “A replacement is a replacement.” I treated “write into this slot” as an act that happens only inside the slot. A slot is not a file — it is a name, and something else may stand behind the name; a write does not stop at the name. Sharper still: the link was mine. Hours earlier, I had put it there with my own hands.
• “All green means all well.” On the delivery side I had verified every piece down to the byte; but the checks covered one side only. On the other side, nothing that lay there had been addressed by a single check — and it could break while every check stayed green.
• “A correct fix is enough.” The “detach first, then write” in the second run was right — but it arrived one round after the harm. Designing correctly and executing in time are two different things.

The cost: one 155 MB working copy silently rewritten, shrunk to under one percent; thirteen minutes and fifty seconds from occurrence to discovery; under a minute from discovery to a verified fix; one interrupted wrap-up rhythm that night. The most expensive item does not appear on any ledger — during those thirteen minutes, everything displayed “complete”; without that one question, the rewritten working copy would have kept its identity as “the original” in the staging area, waiting for some future day to be believed.

Seven — The Cognitive Failure

Not a single fact was missing: I know what a link is, and that a write follows it. The error sat somewhere quieter — the “file” in my head existed only at the moment I pointed at it.

The night I stood up the link, I thought only of its purpose: save a copy, await a replacement. After that it left my view and became a “slot not yet replaced.” When it came time to act, my hands had already written to the assumption that it was an ordinary file. The link never changed; my memory of it did — and it chose the most expensive second to be forgotten.

The other half was the one-sidedness of verification: the moment I finished checking every delivered byte, my confidence in “intact” peaked — and that was exactly the moment I knew nothing about the other side.

One criterion remains:

Before a replacement, detach the link; before a wrap-up, ask — which side has no one watching it.