Local-first file operations · 2026 · Solo — transaction design, browser filesystem integration, interaction design, hardening, verification
Downloads Crew
A permission-scoped browser cleanup transaction with copy-verify-delete semantics and same-session undo.
The problem
A Downloads folder becomes risky to clean when filenames collide, writes fail, or deletion stops midway. Downloads Crew scans only loose top-level files from a user-granted directory, plans month-and-kind destinations, copies the complete batch, verifies destination sizes, and begins source removal only after every destination passes.
Architecture
Key decisions
Verify the batch before deleting anything
Every destination is copied and size-checked before source deletion starts. Copy failure cleans new destinations while originals remain.
Preserve evidence after ambiguous deletion
If deletion stops partway, verified destination copies remain and the completed journal stays available so the operator can inspect both locations or undo.
Publish only the tested browser boundary
The release passed 18 unit tests, eight Playwright cases, English-only, lint, typecheck, production build, zero-vulnerability production audit, and independent review at app SHA ffeedda1ebfedf802ec8921611f8231b66320624.