feat(organize): verify document bundles through move and undo

[seonghobae]

Problem and behavior

Individual organization could separate recordings from companion metadata, split application bundles, or propose protected agent state. Planning now retains those files, explains their status, and leaves files beyond the metadata-probe budget unplanned.

The UI can also preview an explicitly selected existing document folder and destination parent. Supported bundles are flat, contain at most 32 local regular files, and total at most 8 MiB on the current head. Plans and undo receipts bind member names, file identities, exact modification times, sizes, and content digests. New members or changed content prevent movement or undo. Recognized project ancestors, package/session boundaries, links, unavailable content, and cross-volume bundle moves are retained.

macOS same-volume moves use Foundation coordination and the shared exclusive rename primitive. The organizing validator runs inside the accessor, so a companion arriving after preflight prevents mutation. Structured receipt paths preserve filenames containing -> and decomposed Unicode names.

Rule, model-picker, and extension suggestions retain producer provenance in the plan and pending/result move and undo receipts. The preview explicitly labels content as unverified; absent legacy provenance remains unknown. This label is not semantic correctness or move/deletion authority.

Validation

Current exact head 6eca22594fbae409bb81ad19582aa5906514236b adds a read-only command using the same bundle planner as the desktop application. The command has no execution option. Its regression passed (1 test), covering source preservation, absent target creation, collision refusal and help/argument handling. The standalone binary built successfully. A private four-file, 826,183-byte group was previewed in 1,092 ms with unchanged member metadata and no destination creation; this single observation is not a performance benchmark, semantic verdict or iCloud synchronization proof. Hosted Test run 34185604791 is GREEN on this exact head, including the main test job, Windows home-resolution contract and real llama.cpp CPU/FFI build. Independent review and protected stack integration remain pending.

Predecessor 336485563d89f7a85cd90009220c03693910ecbb added fixed-buffer streamed BLAKE3 verification and expanded the flat-bundle observation budget from 512 KiB to 8 MiB. Four focused bundle tests and Svelte check passed locally on that head. Hosted Test 34184735026 was still in progress at the last observation; its Windows and llama.cpp build jobs had passed. No predecessor result is transferred to the current head.

Previous exact head c2101bc401460fc7eded9c348980d50fff36d048 had hosted Test 34182083860 GREEN, including Rust, headless cloud planning, duplicate/archive proof and frontend checks. Linux, Windows and macOS build jobs also passed there. That evidence is historical only and is not transferred to 336485....

Earlier implementation checks (historical evidence, not a full rerun on the current head):

• 33 command tests passed, including whole-bundle movement/undo, late members, same-size/same-mtime content drift, and project-boundary retention.
• 47 shared safety tests passed through native macOS coordination.
• Earlier regressions demonstrated failed filename round-trip and missing post-preflight validation before their fixes.
• The unchanged live cache-cleanup assertion failed in earlier runs and passed after adding diagnostics; its intermittent cause remains unverified and its protection was not weakened.

Integration and limits

Stacked directly on #345 exact 884840f3eff744f9c8a7c97ae410d1ddf5828b09; protected checks and normal merge remain required. This is existing-folder preservation, not completed content/ontology classification. Recursive/larger bundles, crash-durable recovery, iCloud upload and cross-device confirmation, signed-app entitlement behavior, and deployment remain unfinished. Native test processes previously emitted sandbox-extension diagnostics despite successful movement and preservation assertions. Fixtures contain generated test data; no real user folder was moved by these tests.

Integration state — 2026-09-08 KST

This PR is intentionally Draft. #345 remains Draft with protected integration/review prerequisites, and #346 currently has no submitted independent review. Keep the dependent delta open and Draft until the foundation integrates or is normally restacked onto a verified successor, and require terminal exact-head checks for the then-current head. Do not transfer predecessor checks, self-approve, weaken a required gate, force-push, or close valid dependent work.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}