fix(project): recover interrupted publications

[seonghobae]

Exact current identity

• Stacked base: fix/project-save-atomic-publication-962@702396bd11c473c88e410ef4069bf9a1f0bcfc36 (fix(project): stage saves before atomic publication #970).
• Head: codex/project-recovery-journal@3006cd6ec452e6e99e498fe098174f5a4e044a76.
• Open, non-draft, unmerged; no predecessor-head evidence is reused.

Summary

• Add a bounded, same-directory publication journal for existing project replacement.
• Use deterministic target-scoped prepared/published markers so unrelated or incomplete journals do not block another project.
• Restore the known-good or raced competing file preserved by the native exchange, or clean a completed/pre-publication journal when the same target is selected again after an interruption.
• Keep unrecognized identity pairs fail-closed, retain journals when cleanup cannot be proven, and wire recovery into save/load commands.

This is stacked on #970 and continues the crash-recovery portion of #962.

Verification

• cargo fmt --all -- --check
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets --no-default-features -- -D warnings
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features
  • All Tauri unit and persistence integration tests passed, including prepared-exchange recovery, raced competing-file recovery, published-marker cleanup, unrelated incomplete-journal isolation, hard-link fallback, permissions, and parent-symlink cases.
• git diff --check

Security Notes

• Untrusted file names are compared as OS-native raw names; target-scoped journal names are stable hashes, while stage names are restricted to generated UUID-based same-directory names.
• Journal, target, and stage artifacts must be regular non-link files; journal reads use a dedicated 64 KiB no-follow native bound.
• Exchange/promote/cleanup transitions sync the parent directory where the platform supports directory handles; cleanup failures retain a retryable journal.
• An interrupted exchange restores only the regular no-follow displaced inode still held at the journal's generated stage/backup path, and only while the target still matches the journal candidate identity.
• No source path, project content, or journal payload is logged; tests model interruption before/after native exchange.
• Full cross-platform Windows/macOS CI remains required for the native primitives.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9b17a571-e558-4ee7-9e93-1c0f9df03405

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 6 potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 3 new potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Exact-current checkpoint: head 3006cd6; base fix/project-save-atomic-publication-962 at 702396b. CodeRabbit is successful but skipped for this non-default base, Devin Review is successful, and unresolved review threads are 0. reviewDecision is empty and no qualifying independent approval or protected required-check set exists, so this PR remains open and is not merge-ready.