Land the package filesystem shell: streaming atomic package_io, journaled rollback carve-out, asymmetric platform pickers

src/shell/package/package_rollback.h

@@ -0,0 +1,45 @@
+// shell/package/package_rollback — the files ONE import call has landed, as a
+// journal: writes record themselves on success, and rollback() deletes exactly what
+// is recorded — a path this import did not write is structurally impossible to hand
+// it. The deletion carve-out this satisfies is cited at package_rollback.cpp's
+// header.
+
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "shell/package/package_io.h"
+
+namespace reasampler {
+
+struct RollbackResult {
+    int deletedCount = 0;
+    int alreadyAbsentCount = 0;  // vanished between land and rollback — not a failure
+    int failedCount = 0;         // locked / permission — recorded, never thrown
+};
+
+// The evidence for the rollback discriminator: only paths this journal's own
+// writeLandedFile successfully created are recorded, so rollback() can never touch a
+// byte this import did not write.
+class LandedFileJournal {
+public:
+    // Lands one payload at absPath through the atomic temp+rename writer and records
+    // the path on success. REFUSES an existing destination — a bank-folder file is
+    // never overwritten; collision handling is the import plan's job, upstream. An
+    // empty payload is refused too: it signals an upstream read failure, never a
+    // real entry.
+    bool writeLandedFile(const std::string& absPath, const PayloadBuffer& payload);
+
+    // Deletes exactly the recorded files and clears the journal, so a second call is
+    // a no-op. Hard unlink, not trash: nothing ever referenced these bytes.
+    RollbackResult rollback();
+
+    const std::vector<std::string>& landedPaths() const { return paths_; }
+    bool empty() const { return paths_.empty(); }
+
+private:
+    std::vector<std::string> paths_;
+};
+
+}  // namespace reasampler