package: one bank leaves the project as one .rsbank, or the export refuses and says why

Pure planner classifies missing/unreadable/unrepresentable and repairs transport
names; the verb digests, streams and commits atomically over a const session.

src/shell/package/CLAUDE.md

@@ -54,7 +54,10 @@ belong to the verbs.
   `PackageFileWriter` — after any extension append — and get its own consent if that
   re-checked path is `Present`; the dialog's confirm only ever covered the pre-append
   path. Not fixed at this seam: prompting is verb-level UX, and `pickPackageSavePath`
-  has no caller yet, so the gap is latent, not live.
+  has no caller yet, so the gap is latent, not live. **Closed on the export side:**
+  `exportBank` re-checks `fileStatus()` on the post-append path and refuses
+  `RefusedDestinationExists` until the caller sets `allowOverwrite`, which
+  `package_export_action` does only after its own confirm naming that exact path.
 - **The rollback delete is prune's ONE carve-out, and only HALF of it is structural.**
   The citation and the full discriminator live at `package_rollback.cpp`'s header.
   "Did this call create it" is structural: only exclusively-created paths are
@@ -77,6 +80,7 @@ belong to the verbs.
 - `package_io` — every filesystem act the verbs need: `PayloadBuffer` (move-only payload + the `alive()` seam counter), `PackageFileWriter` (append-only temp+atomic-rename writer), `PackageFileReader` (seek-and-read one range per call, range-checked against the real file size), `readFilePayload` (one source file as one entry's payload), `fileStatus` (Present/Absent/Unreadable — export's refusal message must distinguish the last two, and an empty payload cannot), `writeFileExclusive` (exclusive create + write, self-cleaning on a partial write), and `listFolderFileNames` (bare UTF-8 names, sorted, non-recursive, non-throwing). REAPER-free; tested without a DAW.
 - `package_rollback` — `LandedFileJournal`: `writeLandedFile` (exclusive-create land, path resolved absolute, recorded on success only), `markIndexCommitted` (disarms the journal), and `rollback` (deletes exactly the recorded set, hard unlink, tolerating a vanished file; refuses once disarmed). REAPER-free; tested without a DAW.
 - `package_pickers` — `pickPackageForImport` and `pickPackageSavePath`, both `GetUserFileName`. Compile-only until the verbs land; nothing here can be exercised in a unit test.
+- `export_bank` — the promptless export verb, in three composable public steps: `surveyBankExport` (the read-only plan, report-before-acting), `digestSources` (measures each entry's length + `hashBytes` digest, one payload at a time), and `writePackageFile` (prefix, then each payload re-read and re-verified against that digest before it is appended, then commit). `exportBank` composes the three and gates on the plan verdict, the incomplete confirm and the destination confirm. The session arrives **const** — every mutator on it is non-const, so "an export writes no ext state, opens no undo point and never bumps the generation" is enforced by the type rather than remembered. Reads the session through inline accessors only, which is why its tests link and run without a DAW.
 
 ## Gotchas