fix(ai): roll back failed history deletion - #2841

Related issue

N/A - no matching issue was found.

Summary

AI history deletion persisted removal from the owner session index before deleting the message file. If message deletion failed, the owner record was lost; a retry then saw no owned session and silently left the orphaned message path forever. This change restores the original session snapshot on deletion failure and preserves rollback failures as suppressed diagnostics.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • Red tests reproduced lost ownership and missing rollback diagnostics.
  • Focused delete rollback tests: 3 passed.
  • Domain-core reactor: 223 tests passed.
  • Backend package: succeeded.
  • Fork code and CodeQL checks: passed.
  • Merge-tree with atomic history writes: passed.
• Manual verification: N/A - a non-empty directory deterministically forces message-path deletion failure and retry.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: Existing history JSON formats are unchanged.
• Database or driver compatibility: N/A.
• Network, privacy, or security: Non-owner deletion remains unable to touch another user’s message path.
• Community / Local / Pro boundary: Shared Community AI history service.
• Backward compatibility: Successful and non-owner deletes retain existing behavior; failed owner deletes become retryable.

Reviewer map

• Start here: AiChatHistoryServiceImpl.deleteSessionLocal and AiChatHistoryDeleteRollbackTest.
• Failure condition: a message-delete failure removes session ownership or hides rollback diagnostics.
• Rollback or disable path: Revert commit 2e542ba26d30ebcf3ffdbf1b5d5ab2f9f9604bd9; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, deterministic tests, verification, and adversarial review.

Latest-main revalidation (2026-09-04)

• Rebased onto upstream 144a04e; current head 2e542ba.
• Full domain-core module: 229/229 passed.