[chrissotraidis]

A failed final import move could leave the active card save missing: the import deleted matching files before moving its replacement into place. The dated backup survived, but the app still started the game.

Imports now complete the backup, atomically replace the destination and only then remove duplicate copies. They fail closed on directory, backup, replacement and cleanup errors, preserving mixed-case destination names. Startup waits until the import completes, so a pending retry cannot overwrite progress made after an earlier failure.

Validation: synthetic failures reproduced the original missing-save defect and unchecked pending-file deletion. Regression coverage includes enumeration, backup, commit, duplicate cleanup and pending-file cleanup failures, successful retries and mixed-case filenames. The complete combined source suite passes at 23ccb39. A fresh device Release app at 0373950 also builds and passes independent signature/contents verification using the incrementally rebuilt runtime and unchanged personal module; only its executable differs from the previous staged app. The later integration changes scripts/docs, with identical app/runtime inputs. All three hosted checks pass at exact head 23ccb39 (run 38374123269); merged as 4cd86d9 with an identical source tree. Hands-on iPhone import/save/export/reload and device termination checks remain pending. No real saves or installed device apps were changed.