Summary
This PR began with the Unix/macOS download-folder whitespace bug in #528 and expanded into a repair of the filesystem contracts used by imports, audiobook moves, root-folder relocation, scans, file registration, organize/rename, deletion, and path-bearing persistence.
The branch now separates three concepts that were previously conflated:
- Download-client source paths are external filesystem identities. Legal whitespace, case, separators, and client-reported shape are preserved rather than normalized as user input.
- Listenarr-owned destinations and destructive filesystem targets are mutation boundaries. They are validated using explicit filesystem syntax and case semantics, physical-generation evidence, pinned/no-follow filesystem primitives, and race-safe revalidation before mutation.
- Durable recovery evidence is persisted application state. Move jobs, manifests, directory ledgers, ownership rows, file-mutation journals, audiobook deletion intents, scan handoffs, and root-relocation state live in SQLite/application-owned runtime storage. User library paths contain only requested library content and final directories; cross-process lock files live under the Listenarr config runtime directory.
Physical library moves are durable workflows instead of BasePath pre-saves. Jobs persist endpoint identity, tracked-file manifests, lease/retry state, physical-generation proofs, database-backed mutation journals, target-directory state, cleanup authority, and durable scan handoffs so crashes, cancellation, retries, pathname replacement, and stale workers fail closed.
Issues resolved
Closes #528
Closes #598
Closes #765
Closes #438
Related: #766
Platform-specific mutation contract
- Windows: relative directory creation returns a creation-bound handle, so a newly created directory can acquire durable cleanup ownership after its physical generation is persisted and revalidated.
- Unix-like systems: dir...
Automated Canary build