[rteoo]

Summary

• Block Linux directory targets containing nested mounts before deletion, including same-device bind mounts.
• Walk permanent deletions through directory descriptors and compare mount IDs before entering children.
• Add a privileged bind-mount regression to Linux CI.

Testing

• Linux CI: cargo xtask lint and cargo xtask test passed; the privileged bind-mount regression ran and passed (1 test).
• macOS and Windows CI: lint, tests, release build, and binary smoke test passed.
• Local git diff --check passed. Cargo is unavailable on this Windows host, so local Rust checks could not run.

Risks

• Linux permanent deletion requires kernel mount IDs from statx; unsupported kernels fail closed.
• Concurrent same-volume renames can still replace a marked name during deletion.

Related: tobi#9 and tobi#10.