Land the package filesystem shell: streaming atomic package_io, journaled rollback carve-out, asymmetric platform pickers

src/shell/package/package_rollback.cpp

@@ -0,0 +1,40 @@
+// package_rollback.cpp — see package_rollback.h. The rollback delete below runs
+// under the ONE carve-out from prune's exclusive file-deletion authority, stated at
+// src/shell/persist/prune_fs.cpp:5-11; it satisfies that discriminator by
+// construction — every recorded path was created by this journal's own
+// writeLandedFile, and the abandoned index mutation means nothing ever referenced it.
+
+#include "shell/package/package_rollback.h"
+
+#include <filesystem>
+
+namespace reasampler {
+
+namespace fs = std::filesystem;
+
+bool LandedFileJournal::writeLandedFile(const std::string& absPath,
+                                        const PayloadBuffer& payload) {
+    if (payload.empty()) return false;
+    std::error_code ec;
+    if (fs::exists(absPath, ec) || ec) return false;
+    PackageFileWriter writer(absPath);
+    if (!writer.appendPayload(payload)) return false;  // dtor aborts; temp removed
+    if (!writer.commit()) return false;
+    paths_.push_back(absPath);
+    return true;
+}
+
+RollbackResult LandedFileJournal::rollback() {
+    RollbackResult result;
+    for (const std::string& path : paths_) {
+        std::error_code ec;
+        const bool removed = fs::remove(path, ec);
+        if (removed)  ++result.deletedCount;
+        else if (ec)  ++result.failedCount;
+        else          ++result.alreadyAbsentCount;  // no error, nothing there
+    }
+    paths_.clear();
+    return result;
+}
+
+}  // namespace reasampler