fix(storage): roll back failed large mutations

[HandSonic]

Related issue

N/A - no matching issue was found.

Summary

Limited LargeDataStorage evicted and deleted an old record before proving the replacement detail could be persisted. Updates published mutable state before detail writes, while delete/index/detail failures were logged or left reload state inconsistent. This change stages detail/index mutations, publishes memory only after persistence, and rolls back single-step persistence failures. Delete rollback restores the index independently before attempting detail-file restoration, so a detail restore failure cannot hide the record from reload.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Current-main reproduction: the original large-storage tests reproduce lost evictions, failed-update memory divergence, and swallowed delete failures.
• Focused tests after the fix: LargeDataStorageTest 15 passed, including failed detail/index writes, capacity eviction, update/delete rollback, and the detail-restore-failure regression.
• Storage reactor package after the fix: storage 76, tools 77, domain-api 27; 180 tests total, zero failures/errors/skips.
• Command: mvn -B -ntp -f chat2db-community-server/pom.xml -pl :chat2db-community-storage -am -Dmaven.test.skip=false -DskipTests=false '-Dsurefire.includes=**/*Test.java' -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.test.failure.ignore=false package. Test JVM home/temp directories were isolated.
• Executable backend package passed.
• Real macOS locked-detail regression passed: an undeletable detail file caused delete to fail while the index, memory and reload state all retained the record. This verifies the corrected rollback ordering.
• Existing Playwright API/restart reproduction was rerun against the prior head and is retained in the review report; the fix-only change is covered by the real locked-file regression and focused tests. No UI behavior or public API changed.
• New-head CI is triggered by this update; its current result is available in PR checks.

Risk and compatibility

• Public API or stored data: Existing index/detail formats and method signatures are unchanged.
• Database or driver compatibility: N/A.
• Network, privacy, or security: N/A.
• Community / Local / Pro boundary: Shared Community large local storage base class.
• Backward compatibility: Successful insert/update/delete ordering is preserved; failures now throw instead of reporting false success.

Reviewer map

• Start here: LargeDataStorage.save, update, removeDataStrict, then fault-injection tests.
• Failure condition: one persistence failure loses an old record, publishes an unpersisted value, or reloads a different state.
• Rollback or disable path: Revert commits 4d89722ca462b1146f47fc005f283aa8e2198943 and dce24b4e15c2c842268b0d12a4ec6b9c97987bcf; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, automated tests, verification, and adversarial review.