fix(ai): write chat history atomically

[HandSonic]

Related issue

N/A - no matching issue was found.

Summary

AI session and message histories were written directly to their final JSON files. Jackson truncates a File target before serialization, so a mid-write failure destroyed the last valid history and made subsequent reads fail. This change writes to a same-directory temporary file, atomically replaces the target when supported, cleans failed temporary writes, and constrains message paths to canonical UUIDs inside the normalized history directory.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • Red serializers truncated valid session/message files to 27 bytes and made them unreadable.
  • Atomic history, path-safety, compatibility, and locking tests: 7 passed.
  • AI history/config related tests: 38 passed.
  • Domain-core reactor: 226 tests passed.
  • Backend package and fork code/CodeQL checks: passed.
  • Merge-tree with history deletion rollback: passed.
• Manual verification: N/A - custom serializers flush a partial prefix before throwing and verify final bytes/readability/temp cleanup.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: Existing JSON schemas and paths are unchanged.
• Database or driver compatibility: N/A.
• Network, privacy, or security: Canonical UUID validation and strict parent checks prevent history paths from escaping the configured directory.
• Community / Local / Pro boundary: Shared Community AI history service.
• Backward compatibility: Successful writes preserve pretty JSON; unsupported atomic moves fall back to replacement.

Reviewer map

• Start here: AiChatHistoryServiceImpl.writeAtomically and AiChatHistoryAtomicWriteTest.
• Failure condition: a failed serializer changes the final file or leaves a temporary file.
• Rollback or disable path: Revert commit 23f7627f50e9b2745c4c53a2e83982e6354fd32e; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, deterministic tests, verification, and adversarial review.

Latest-main revalidation (2026-09-04)

• Rebased onto upstream 144a04e; current head 23f7627.
• Full domain-core module: 233/233 passed.