[mikecerisano]

On exFAT/FAT, the old copy fallback claimed an empty destination name and then renamed a temporary file over it. Another writer could replace that claim between the identity check and rename, or have its replacement deleted during failure cleanup. This change removes that race for media files: BitMatch durably saves a visible, per-attempt warning before creating final filenames with exclusive create. An interrupted copy leaves its partial file and incomplete warning in place; existing destination files are never replaced or deleted.

The warning is checked before each new file, periodically during long writes, and before the result is accepted. It records file-evidence status only. Independent destination readback, exact selected-file coverage, named-file identity checks, ASC MHL/report work, and the journal still determine the final verdict. Compare and Check recognize only exact, valid destination status files; a same-named source file stays selected data. Unrecognized filesystems without safe hard-link publication fail closed. APFS publication is unchanged.

Local validation:

• Engine XCTest: 165 tests, 18 skipped, 0 failed; Swift Testing: 181 tests, 6 skipped, 0 issues.
• Mac app tests: 1,226 passed, 14 skipped, 0 failed. Mac and iPhone/iPad simulator builds passed.
• Focused final-publication tests: 24 cases, 1 skipped, 0 failed, including interrupted output, marker loss, replacement, reuse, and marker-name collision.
• Mounted exFAT Standard copy → independent readback → ASC MHL handoff passed. Its marker F_FULLFSYNC and root-directory fsync returned success.

FAT32 could not be mounted on this Mac (hdiutil: Device not configured), so FAT32 filesystem behavior and physical-drive/power-loss behavior remain unverified. This does not establish the cause of issue #10. The separate ASC MHL empty-directory claim race is tracked in docs/TODO.md.