Harden ADE against disk-full and interrupted-write incidents

[arul28]

Summary

Incident response + product hardening for the July 12 disk-full outage, where a full disk during a kvDb table rebuild bricked every subsequent launch and two chats silently lost their Codex threads. This PR makes a full disk an ordinary operating condition: canonical data is never silently lost, ADE recovers automatically when safe, and a nontechnical user gets a guided, jargon-free recovery path.

Durability

• Table rebuilds are transactional (BEGIN IMMEDIATE, row-count-verified, index-preserving); a startup recovery pass classifies staging tables stranded by older builds (drop empty/partial, complete interrupted renames, never drop ambiguous data) and runs before migrate(). Also stops the previously unprotected rebuild of automation_ingress_events that ran on every startup.
• Chat metadata writes are atomic with one .lkg previous generation; provider-pointer changes are journaled to a bounded (64 KiB) ledger; truncated transcript tails are healed instead of corrupting the next append; pre-migration DB backups are headroom-checked, size-verified, and singular.

Continuity

• A provider resume failure can no longer silently replace a chat's thread: failures are classified (missing thread vs optional-MCP vs transient, with a rollout-file existence probe), replacing a pointer requires an explicit token, and the chat shows a recovery card — Retry original thread / Recover from ADE history (bounded ≤24 KiB capsule, marked reconstructed) / Start a new chat (linked). Startup reconciliation restores lost pointers from the ledger, SQLite resume commands, or transcript events.

Recovery UX

• Typed recovery errors (AdeRecoveryErrorCode) survive IPC; the brain writes bounded machine/project last-failure reports, backs off on crash loops, dedupes repeated failure logs, and copytruncates launchd logs at 10 MiB.
• Project-open failures mount a full-screen plain-language recovery surface with one-click Repair (space check → stop service → validate DB → finish interrupted saves → restart → verify RPC → chat reconciliation report). Repair never deletes a file. The primary-socket safety guard is unchanged — only its user-facing mapping improved.

Storage

• ADE-scoped disk-pressure monitor (normal/warning/critical/exhausted, rise-fast fall-slow, fail-open): quiet top-right indicator; at exhausted, new chat turns / ADE-launched CLI sessions / managed process starts are refused with calm copy; running work is never touched.
• Settings → Storage dashboard: disk gauge, plain categories with safety badges, per-lane itemization of archived and deleted-lane leftovers, preview-confirmed cleanup with server-side protection of canonical data; scanner is symlink-safe and covers os.tmpdir ade-* staging.
• Old inactive chat/terminal history gzip-compresses with verify-before-delete, transparent reads (search included), and reinflate-on-append.
• CLI parity: ade storage snapshot/compress, last-failure line in ade brain status, storage line in ade doctor.

Tests & docs

• Shared fault-injection utility + an end-to-end incident replay (SQLITE_FULL mid-rebuild, ENOSPC mid-write, restart self-heal, pointer reconciliation, repair flow, symlink containment), per-statement migration fault injection, real SQLITE_FULL via PRAGMA max_page_count.
• New docs/features/storage-and-recovery/README.md (contracts + all retention bounds) plus updates to chat, terminals, search, settings, remote-runtime docs and ARCHITECTURE.

Validation

• Desktop: 8/8 vitest shards green under Node 22 except one pre-existing failure (syncHostService.test.ts "streams terminal snapshots…" — reproduces identically at the branch base f9344115 on this machine; unrelated to this diff).
• ade-cli: 84 files / 1,725 tests green. Typecheck, lint, and builds green for both apps.
• Note: remoteRuntime.offlineRpc.integration.test.ts is a dormant pre-existing test that no vitest project ran before this branch; the new integration-main project is deliberately scoped so it stays dormant (see comment in vitest.workspace.ts).

🤖 Generated with Claude Code

  Open in ADE  ·  ade/start-skill-work-remebr-guidance-edba0f69 branch  ·  PR #797

Summary by CodeRabbit

• New Features
  • Added a Storage settings experience with disk-pressure indicator, storage snapshots, cleanup previews, safe removals, and history compression.
  • Added ade storage / ade disk CLI commands for snapshot, compress, and maintenance actions (including text output).
  • Added Project Recovery takeover flow (diagnose/repair) and chat continuity recovery UI.
• Improvements
  • Transparently read and index gzip-compressed chat/terminal transcripts.
  • Expanded disk-pressure protections across readiness checks and runtime operations.
• Tests
  • Added unit/integration coverage for storage, recovery, compression, disk-pressure behavior, and failure deduplication/backoff.

Greptile Summary

This PR hardens ADE storage, recovery, and continuity paths against disk-full and interrupted-write failures. The main changes are:

• Transactional database rebuild recovery and safer startup handling.
• Atomic chat metadata writes and thread-pointer reconciliation.
• Guided project recovery UI and typed recovery errors.
• Disk-pressure monitoring, storage dashboard, safe cleanup, and history compression.
• CLI storage commands plus updated tests and documentation.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

T-Rex Logs

What T-Rex did

• The initial disk-full-incident integration test run completed with Vitest reporting 5 tests passed, but the wrapper exited with code 2 due to a /bin/sh: 1: Bad substitution.
• A clean retry was performed with the exact command, working directory, and timestamps, and the Vitest run completed with exit code 0.
• The clean run summary reported Test Files 1 passed (1), Tests 5 passed (5), duration 5.69s.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
apps/desktop/src/main/services/storage/storageInsightsService.ts	Cleanup confirmations now carry preview identities and recheck them before removal.
apps/desktop/src/main/main.ts	Desktop runtime wiring now includes storage services and documents the daemon-backed fallback behavior.
apps/ade-cli/src/bootstrap.ts	The daemon runtime now wires disk pressure and storage insights for headless projects.

_{Reviews (8): Last reviewed commit: "Compress at warning level and decompress..." | Re-trigger Greptile}