Summary

Follow-up hardening for merged PR #230. The cache migration now refuses a symlinked legacy cache root before composing records / energy-wal.bin child paths, and it treats any destination filesystem entry, including a dangling symlink, as occupied so the no-overwrite migration invariant holds.

Target PR reviewed

• feat: unify cache paths via platform-aware dirs::cache_dir() (#229) #230: feat: unify cache paths via platform-aware dirs::cache_dir() (cache: unify record/energy-WAL/users-CSV paths via platform-aware dirs::cache_dir() (Scope B from #223) #229)

Linked Original Issues Reviewed

• cache: unify record/energy-WAL/users-CSV paths via platform-aware dirs::cache_dir() (Scope B from #223) #229: cache: unify record/energy-WAL/users-CSV paths via platform-aware dirs::cache_dir() (Scope B from record: default output path is inconsistently documented and resolved (and not platform-aware) #223)
• record: default output path is inconsistently documented and resolved (and not platform-aware) #223 and fix: resolve record default output path consistently (#223) #227 reviewed as context from the PR body / issue references.

Review Findings

• The merged migration helper checked symlinks at ~/.cache/all-smi/records and ~/.cache/all-smi/energy-wal.bin, but not at the legacy root ~/.cache/all-smi itself. A symlinked legacy root could therefore be followed while resolving child migration targets, which conflicts with the threat model documented in PR feat: unify cache paths via platform-aware dirs::cache_dir() (#229) #230 and the users-CSV cache-dir symlink refusal.
• The destination guard used Path::exists(), which treats a dangling destination symlink as absent. That does not redirect writes, but it weakens the stated "never overwrite destination" invariant because an existing filesystem entry could be replaced.

Correctness Fixes

• Split the root migration into migrate_legacy_cache_root(old_root, new_root) so tests can exercise the root-level decision without mutating process-global home/cache state.
• Use symlink_metadata() on the legacy root and return before create_dir_all(new_root) or target joins when the root is a symlink or cannot be inspected.
• Use symlink_metadata() for destination occupancy so files, directories, symlinks, and dangling symlinks all preserve the existing destination and skip migration.

Security Fixes

• Root-level symlink refusal now matches the existing writer-side and users-CSV hardening rationale: a pre-planted ~/.cache/all-smi symlink is skipped rather than followed into attacker-controlled paths.
• Added Unix regression coverage proving the migration does not create the new cache root or move data when the legacy root is a symlink.

Performance And Reliability

• The change adds only one metadata lookup on startup when the legacy and platform cache roots differ. The migration remains best-effort, non-blocking on inspection errors, and still avoids copy/delete fallback across filesystems.
• Added coverage for dangling destination symlinks to preserve the no-overwrite invariant under edge-case filesystem states.

Validation

• env -u NO_COLOR RUSTFLAGS="-L /tmp/drmlinks" cargo test --bin all-smi cache_migration::tests:: -> passed, 7 tests.
• env -u NO_COLOR RUSTFLAGS="-L /tmp/drmlinks" cargo test --bin all-smi -> passed, 1174 passed, 1 ignored.
• env -u NO_COLOR RUSTFLAGS="-L /tmp/drmlinks" cargo test --test config_file_integration_test -> passed, 15 tests.
• RUSTFLAGS="-L /tmp/drmlinks" cargo clippy --bin all-smi --tests -- -D warnings -> passed.
• cargo fmt --check -> passed.
• Note: the same binary unit suite fails under this local shell's ambient NO_COLOR=1 because ui::renderers::memory_renderer::tests::test_swap_row_active_uses_red_color intentionally asserts emitted red SGR; unsetting NO_COLOR matches CI behavior and passes.

Refs #229
Refs #230