[mikecerisano]

A destination file could be replaced with different bytes of the same size after Standard verification and before final coverage. The final check previously compared only pathname and size, leaving the saved row verified even though that pathname now referred to a different file.

Recheck each selected final name through a read-only, no-follow directory walk and compare its identity with the file that supplied readback bytes. A mismatch or failed recheck replaces the verified row with an explicit failure and does not emit completed progress. Also check the current name when a pinned read finishes, which matters on filesystems with weak change-time metadata. Quick mode remains copied-unverified.

Validation:

• The post-verification same-size swap failed against the prior code: the row remained success && verificationResult.isValid. Mid-read APFS substitution was already rejected by the existing pinned-file stability check.
• Focused race suite: 3/3 passed on APFS and 3/3 passed on a disposable mounted exFAT image, including a nested folder. The source and original destination bytes were preserved; the image was detached and removed.
• Full engine: XCTest 145 run, 17 skipped, zero failures; Swift Testing 181/181 passed.
• Full Mac app suite with parallel testing disabled: passed, 1,226 passed and 14 skipped in the result summary. iPad/iPhone simulator target: build succeeded.
• The default parallel Mac suite had one different scheduling-sensitive failure in each of two runs (SharedSelectionTests.coordinatorIsAnalysingRightAfterASourceIsChosen and OperationStateSingleSourceTests.automaticPausePausesTheEngine). Both passed together when run focused. These were not established as main-branch regressions; the serial full suite passed.

No release is included. The separate exFAT/FAT publication redesign is outside this PR.