fix(ai): roll back failed history deletion

[HandSonic]

Related issue

N/A - no matching issue was found.

Summary

AI history deletion persisted removal from the owner session index before deleting the message file. If message deletion failed, the owner record was lost; a retry then saw no owned session and silently left the orphaned message path forever. This change restores the original session snapshot on deletion failure and preserves rollback failures as suppressed diagnostics.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Current-main reproduction: the 3 rollback tests ran with 2 failures, showing lost session ownership and missing rollback diagnostics. The non-owner case passed.
• After main integration, owning reactor tests and package passed: domain-core 358, SPI 191, tools 77, domain-api 27; 653 total, zero failures/errors/skips.
• Command: mvn -B -ntp -f chat2db-community-server/pom.xml -pl :chat2db-community-domain-core -am -Dmaven.test.skip=false -DskipTests=false '-Dsurefire.includes=**/*Test.java' -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.test.failure.ignore=false package. Test JVM home/temp directories were isolated.
• Executable backend package passed. Playwright CLI tested actual history-menu deletion using isolated seeded conversations: cancel sent zero writes; normal/empty sessions deleted; same-title neighbors remained intact.
• A real macOS message-file lock caused repeated UI deletes to fail with visible feedback. All session/message file bytes were unchanged, and refresh plus backend restart retained the conversation and its messages. After unlocking, keyboard-confirmed retry succeeded; repeated delete was harmless.
• A browser HTTP delete request for a different synthetic owner did not alter files, and that owner's messages remained unreadable. No external model was called.
• The two integrated PR files are byte-identical to the Web-tested version. Current-head CI is available in PR checks.

Risk and compatibility

• Public API or stored data: Existing history JSON formats are unchanged.
• Database or driver compatibility: N/A.
• Network, privacy, or security: Non-owner deletion remains unable to touch another user’s message path.
• Community / Local / Pro boundary: Shared Community AI history service.
• Backward compatibility: Successful and non-owner deletes retain existing behavior; failed owner deletes become retryable.
• This is compensation for a caught deletion error, not a transaction across the session and message files. Process crashes or a further rollback failure can still leave inconsistent files; rollback failures remain attached to the original exception.

Reviewer map

• Start here: AiChatHistoryServiceImpl.deleteSessionLocal and AiChatHistoryDeleteRollbackTest.
• Failure condition: a message-delete failure removes session ownership or hides rollback diagnostics.
• Rollback or disable path: Revert this PR; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, deterministic tests, verification, and adversarial review.