Store each space in its own file (schema v5)

[jonascript]

Why

Everything ike knows lived in one `tasks.json`: one corrupt write or bad hand edit put every space at risk, and moving a single space between machines required the export/import dance. This splits storage so each space is its own file — corruption in one space cannot touch the others, and a space becomes a copyable unit.

What changed

Layout (data format v5). `tasks.json` becomes a small manifest (`version`, `current`, both consent flags — deliberately no `spaces` key, so a v4 binary refuses it rather than reading an empty matrix). Spaces live in `tasks.json.spaces/`, one self-describing file each, with its own rolling `.bak`. Filenames are derived from the space name via a minimal percent-encoding (`/`, `%`, leading dot); the embedded name is canonical.

Write path. `mutateFile` is still the one write path, same single flock. The commit step (`writeTree`) dirty-checks per file — a mutation rewrites only the spaces it touched — and orders creates/updates → manifest → deletes so every crash window leaves a state the reader already repairs. Deleting a space renames its file to `.bak` (removal + backup in one atomic step). A case-only rename is guarded by `os.SameFile` so macOS's case-insensitive FS can't delete the file just written.

Degraded open. A space file that fails to parse costs that one space: the others keep working, the broken one is listed as unreadable everywhere (CLI, TUI picker, MCP `list_spaces`), nothing ever writes over its file, and `ike space rm --force` retires it to `.bak` as the recovery affordance. A `Current` naming a corrupt space fails loudly instead of being silently repaired away. Consent status keeps answering from the manifest even with every space corrupt.

Migration. On first write, never on read: the monolith (any version back to v1) is served in memory indefinitely; the first mutation splits it, keeps the original as `tasks.json.pre-v5.bak` (permanent), clears crash debris, and commits via the manifest write. Older binaries mid-window still see a valid v4 file.

Portability. `ike space export` now writes exactly the space's own file — export and a hand copy are byte-identical, and consent flags structurally cannot travel. A single exported space still opens with `--file` for reading and editing (lifecycle ops refuse). Import accepts all three shapes: v≤4 envelope, v5 space file, whole v5 tree with `--all`.

Fixed along the way: `ike space rename` used to strand the space's plans under the old name; it now moves the plans dir under the same lock, and `ike plan --prune` sweeps plan dirs of spaces that no longer exist (sparing unreadable ones).

ModTime (the TUI's poll signal) is now two stats — manifest + spaces dir — which covers every kind of write.

Testing

• Full suite green at every commit; the readTree refactor commit passes with zero test edits, proving the legacy read path byte-for-byte.
• New tests: codec round-trip/injectivity, migration (split, pre-v5.bak permanence, crash-debris clearing), ModTime bumps per write kind, degraded open (healthy spaces work, corrupt bytes untouched, rm --force recovery, corrupt Current stays), lifecycle on-disk mechanics (rename moves file+plans, case-only rename, rm-keeps-bak), export≈copy, standalone editing, three import shapes.
• Durability tests re-pinned per file (modes incl. tightening on skipped writes, per-space .bak, temp patterns, lock).
• Manual end-to-end run: v4 fixture → read stays v4 → first write migrates → corrupt a space → others fine, listing marks it, rm --force recovers → export == space file → standalone edit → import.

🤖 Generated with Claude Code