Safety & undo
A filing tool holds your originals in its hands. Qix's answer is a short list of rules it cannot break — encoded as tests, including a fuzz test, that gate every release.
The invariants
- No deletion, ever. There is no code path that removes a user file. "Delete" means the macOS Trash, where you can look at it, restore it, or let it age out. Even cross-volume moves trash the source copy rather than removing it — and only after the destination is verified.
- No overwrites, ever. Every write — metadata, caches, state files — goes to a temporary file and lands with an atomic rename. A crash at any instant leaves the original intact.
- Live pairs are atomic. Any operation on a Live Photo completes for both members or neither, basenames in sync. A fuzz test runs randomized operation sequences against fixture trees and asserts that no sequence, however unlucky, produces a split pair.
- Imports are verified before recorded. An asset enters the imported ledger only after its files exist, have bytes, and parse as images.
- Caches hold nothing. Thumbnails and the metadata index are rebuilt from the files at any time. If a feature would need a real database, the feature is wrong.
- External changes abort cleanly. Every operation re-checks its targets (re-stat) immediately before executing each step. If Finder, a sync tool, or another app touched the file in between, Qix stops with a clear error instead of operating on a guess.
- Photos.app is read-only. Qix calls no PhotoKit mutation API. Your Photos library cannot be changed by Qix, by design and by test.
Undo ⌘Z / redo ⇧⌘Z
Every file operation and metadata edit lands in a session journal with its exact inverse:
- A move undoes to a move back.
- A batch rename undoes as one entry, every name restored.
- A trash — including a culling commit's rejects — undoes by restoring from the Trash.
- Keyword, rating, and caption edits undo to the exact previous values, not just "cleared".
- A cross-volume move undoes by restoring the trashed source and retiring the copy.
Batches are single entries: culling five rejects away is one ⌘Z, not five. Agent-made edits (see Agents) journal identically — you can undo an AI's work the same way you'd undo your own.
The session log
The status bar tracks running operations; the log panel keeps the session's history — imports, moves, writes, and anything that went wrong, in order. If an operation aborted because a file changed underneath it, this is where the story is.
Why "plain files" is a safety feature
Every design in Qix routes back to one principle: the filesystem is ground truth. Keywords in the files. Ratings in the files. The folder tree as the organization. State in human-readable text. It means:
- Any backup tool backs up everything, tags included.
- Any other program — today's or 2040's — reads the library without an export step.
- If Qix vanished tomorrow, you'd lose a nice interface and nothing else.