refactor: reshape three oversized files into focused modules

[perfectra1n]

Splits the three largest hand-written files in the repo. Each was large for a different reason, and two of them were large because of an actual defect.

	before	after
src/undo/mod.rs	1397	21 (declarations + re-exports)
src/handlers/config.rs	1090	gone → 7 focused files
tests/test_onboarding.rs	1088	282 + two sibling suites

Four commits, each independently reviewable. Commit 1 must land first — commit 3 depends on it.

The defects this surfaced

A -5 at the max-file-size prompt silently disabled all syncing

Both prompt modes did parse::<f64>() then (mb * 1024.0 * 1024.0) as u64. Rust's float→int cast saturates, so -5 became max_file_size_bytes = 0, which makes FilterConfig::should_include reject every file. NaN did the same; 1e30 became u64::MAX.

The existing .context("Invalid number. Must be a positive number.") already claimed a positivity check that was never performed. Neither of the two copies caught it, and neither could be tested — the parsing was welded directly to the inquire prompt, so it only ran with a TTY attached.

This is a behaviour change, not a pure refactor, and it's typed fix(config): so it reaches the changelog.

The entire module tree compiled twice

src/main.rs re-declared all 15 modules as private mods while also importing claude_code_sync::VerbosityLevel from its own library. The tree compiled once into the lib and again into the bin, producing two incompatible type universes that happened to share names.

This is also why undo/mod.rs carried #[allow(unused_imports)]: in the lib those pub uses are real public API, but in the bin mod undo was private, so they were unreachable and warned. The attribute was load-bearing — and a symptom.

main.rs is now a consumer of the library. Five of the six #[allow(dead_code)] in undo/ turned out to be artifacts of the same thing and are gone; the compiler confirmed which one was real.

Test env cleanup didn't survive ?

21 tests set CLAUDE_CODE_SYNC_CONFIG_DIR and removed it in a bare trailing statement. Those functions return Result<()> and use ? throughout, so any early return — not just a panic — skipped the cleanup and left the variable pointing at a TempDir about to be deleted. Every later test in the same binary then resolved config against a path that no longer existed. Now an RAII guard whose Drop runs on the unwind path too.

Separately, four tests ran with no override and no #[serial], and two of them mkdir'd in the developer's real ~/.config — a comment in the old file admitted it. Guarded now.

Verification

mise run ci is green (fmt, clippy --all-targets -- -D warnings, build, tests).

Test count drops 490 → 347, and that is the fix working. 154 of those entries were the bin harness re-running the lib's own tests. The invariant checked was the set of unique test paths, baselined before any change:

before:  490 raw / 336 unique   (154 duplicates = the double compile)
after:   347 raw / 347 unique   (raw == unique: nothing runs twice)

Unique paths went 336 → 347. Every original test still exists — the 32 undo:: and 6 config:: changes are renames with matching leaf names — plus 11 new unit tests, the first fields.rs has ever had.

Reviewer notes

• interactive and wizard keep separate prompt flows on purpose. They are not accidentally different: interactive treats empty input as "clear this setting" and says so; the wizard asks "Do you want to…?" first and has no clear affordance. Only the value logic is shared, not the prompt shape.
• snapshot.rs was split into snapshot.rs + differential.rs — a fifth module beyond the original plan. With its tests it would have hit ~790 lines, worse than what this PR is fixing. The seam (full snapshots vs. differential chains) was already there, and restore.rs already used the same sibling-impl Snapshot idiom.
• prompt_artifact_toggle_selection lives in prompts.rs, not fields.rs — it runs a MultiSelect, so it isn't TTY-free and would have falsified that module's whole premise.
• Four files are still over the ~350-line target: operations.rs (525), differential.rs (472), snapshot.rs (450), test_multi_repo.rs (404). The production code in each is comfortably under; colocated #[cfg(test)] blocks push the totals over. Flagging rather than contorting the structure.
• If you squash-merge, the fix(config): type is lost and the file-size fix won't appear in the changelog. A merge commit preserves it.

Two further fixes, added on review

Snapshot::restore created files outside the home directory before rejecting them

The traversal check needs a canonical path; canonicalize requires the path to exist. So the code created the parent directories and wrote an empty file, then validated — and on rejection returned early, leaving both behind. A snapshot naming a path outside home got directories and a file placed there before being refused.

The existing traversal test only passed because it aimed at /etc/passwd, which already exists — so the create-first branch never ran.

Paths are now resolved without touching the filesystem: reject .. up front, walk to the deepest ancestor that does exist, canonicalize that (resolving symlinks in the prefix), re-attach the remaining components literally. They don't exist so they can't be symlinks, and they aren't .. because we just checked.

Existence is probed with symlink_metadata, not exists — exists follows symlinks and reports false for a dangling one, so treating it as merely absent would let us re-attach its name to a canonical in-base prefix, pass the check, and have fs::write follow it straight out of the sandbox. There's a test for exactly that.

FilterConfig::validate() never checked the file size limit

max_file_size_bytes = 0 was accepted, and 0 makes should_include reject every non-empty file — sync silently does nothing.

Strict on write, forgiving on read. validate() now rejects 0 so it can't be introduced via the CLI; load() repairs a 0 to the default and warns on stderr rather than erroring.

That asymmetry is deliberate, and it's the interesting part: configs in the wild already contain a 0, because the -5 bug above wrote it there. Hard-failing on load would be a trap — handle_config_interactive opens by calling FilterConfig::load(), so erroring would take down the one command that can fix the value, leaving hand-editing TOML as the only way out.

7 new tests. Unique test paths: 336 → 354.

Crate docs

The Architecture list linked to a git module that doesn't exist (it's scm, which abstracts over Git and Mercurial). Fixing it surfaced two more, both actively misleading:

• The doc block describing "Platform-agnostic configuration directory management… XDG on Linux, Application Support on macOS" sat directly above pub mod artifacts;, so rustdoc rendered it as the documentation for artifacts — while config, which it actually describes, had none at all.
• scm's own doc claimed "a unified interface for Git". The point of the abstraction is that it isn't Git-only — src/scm/hg.rs exists and CI runs a Mercurial matrix.

Verified with RUSTDOCFLAGS="-D rustdoc::broken_intra_doc_links", which is stricter than the doc CI task (that one doesn't deny rustdoc warnings, which is why the link survived). The crate is clean under it.

---

Everything I flagged as out-of-scope has now been fixed. Nothing outstanding.