[Sad Catapella B8][Data safety] CLI --log opens arbitrary files before validating experiment and output paths #99

Basis

Batch 8, pinned commit d7a538e56d41ac1093ba79adcad397c21b3dfd32. Confirmed unsafe write path by source inspection; no destructive reproduction performed.

Evidence

• main() lines 298–308 attaches the log handler before executing _run or _masks and before any preflight/path validation.
• _attach_log() lines 616–623 calls logging.FileHandler(path) with append-by-default behavior, creating or altering any writable user-supplied path.
• run_experiment() documentation lines 362–369 promises the experiment folder is never written; similarly notebook guidance. Logging currently bypasses the output path rule.
• CLI tests use only a safe tmp_path/run.log; no experiment/manifest collision test.

Reproduction outline

morphobricks-preprocessing run EXP --axes YX --log EXP/notes.txt creates a new file inside the experiment before processing; --log EXP/image.tif appends logging messages to an existing microscopy input (potential file corruption); --log OUTPUT/experiment_design.csv can append text to a published scientific artifact. Even an invalid run can produce these writes.

Impact / fix

Contradicts read-only input guarantee, can change discovered inputs and corrupt source or generated records. Before constructing any FileHandler, resolve and validate --log target against the experiment root, input file identities, reserved output artifacts, and output staging paths (including symlink containment policy from #81). Prefer requiring a dedicated logs directory outside the data tree; document any explicit override. Keep log path validation before any write and report actionable CLI errors. Add negative tests for input and output collisions and a positive external path. Numba irrelevant.