belt and suspenders check

It's possible for there to be multiple queued changes all adding the same
file, and for those changes to be reordered. Maybe. This check will guard
against that ending up adding the wrong version of the file last.

Assistant/Committer.hs

@@ -118,7 +118,7 @@ handleAdds st changechan cs = returnWhen (null pendingadds) $ do
 
 		add :: Change -> IO (Maybe Change)
 		add change@(PendingAddChange { keySource = ks }) = do
-			r <- catchMaybeIO $ runThreadState st $ do
+			r <- catchMaybeIO $ sanitycheck ks $ runThreadState st $ do
 				showStart "add" $ keyFilename ks
 				handle (finishedChange change) (keyFilename ks)
 					=<< Command.Add.ingest ks
@@ -140,6 +140,16 @@ handleAdds st changechan cs = returnWhen (null pendingadds) $ do
 			showEndOk
 			return $ Just change
 
+		{- Check that the keysource's keyFilename still exists,
+		 - and is still a hard link to its contentLocation,
+		 - before ingesting it. -}
+		sanitycheck keysource a = do
+			fs <- getSymbolicLinkStatus $ keyFilename keysource
+			ks <- getSymbolicLinkStatus $ contentLocation keysource
+			if deviceID ks == deviceID fs && fileID ks == fileID fs
+				then a
+				else return Nothing
+
 {- PendingAddChanges can Either be Right to be added now,
  - or are unsafe, and must be Left for later.
  -