The bundle spec close (reconcileBundle in internal/core/intent/bundle.go) pre-flights no destination, so a shipped/<name> collision on the second member moves the first member before the rename refuses; the rollback restores it byte-identical, but the doc comment's claim that every other refusal fires before anything moves is false. PlanBundle has the per-member Lstat pre-check this close lacks.

The bundle spec close (reconcileBundle in internal/core/intent/bundle.go) pre-flights no destination, so a shipped/<name> collision on the second member moves the first member before the rename refuses; the rollback restores it byte-identical, but the doc comment's claim that every other refusal fires before anything moves is false. PlanBundle has the per-member Lstat pre-check this close lacks.

Grounds

• pursued: we expect a twin at any member's shipped/ path to refuse the close before any member moves, with a refusal that says nothing moved; shown wrong if a refused bundle close ever reports a rollback for a destination it could have seen