fix(reliability): preserve evidence and bound recovery paths

[jmagar]

File-tail restarts could lose undelivered history, incident queries could combine hosts or hide incomplete evidence, and deployment failures could leave an agent without a recoverable predecessor. The browser workspace could also retain stale evidence across credential changes or show synthetic graph data. This change preserves delivery and evidence identity, bounds expensive work, and makes replacement and workspace resets explicit.

Changes

• Persist a bounded private file-tail outbox and source cursor; replay unacknowledged records across restarts, report rotation/history gaps, and stop permanent rejection retries with pending evidence retained. Preserve IPv6 and URI identities in retention partitions.
• Batch indexed incident-anchor retrieval by hostname/session/project/tool/time, with 500 rows per window and a shared 50,000-row request budget. Propagate sampling cutoffs through filtered and empty responses, use heavy-read admission, and derive incident IDs from event groups rather than sampled anchors.
• Bound staged version validation and SSH phases, including descendant-held pipes. Stage Unraid replacement with rollback of the prior environment/container and preserve recovery artifacts if rollback cannot finish. Preserve host proof and mark metadata field-budget omissions regardless of JSON map ordering.
• Reset workspace and inspector state on Clear/token replacement, reject stale request completions, expose ambiguous host evidence, and show an empty graph when evidence is empty. Exercise the actual Rust-served assets through an isolated browser harness. Replace unlimited module-size exceptions with fixed ceilings and ownership metadata; update the owning guides.

Verification

• Workspace Nextest: 3,830 passed, 5 skipped across 15 binaries.
• Clippy: all targets/all features, warnings treated as errors; formatting, diff, and workspace doctest/rustdoc checks passed.
• Frontend: 14 unit tests and 10 desktop/mobile Playwright cases passed; lint, typecheck, and build passed.
• Generated-document, integration-contract, module-size/self-test, instruction-link, repository, plugin, and version-synchronization checks passed. Git pre-commit and pre-push hooks passed.

Reviewer considerations

Previously saved incident IDs that included transcript anchors must be refreshed through listing. Incomplete windows explicitly report provisional scores/signals. Permanent file-tail rejections retain pending state for operator recovery.

Browser tests use real served assets with intercepted API fixtures and cached Chrome 153 (revision 1243), rather than Playwright's absent expected revision 1228. Native Windows, appliance/live Docker replacement, and end-to-end collector delivery were not qualified; replacement success verifies version and running state, not an ingest receipt. No deployment was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T07:02:30.676172Z	33c49b1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33c49b14c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Replace existing checkpoints atomically on Windows

On Windows, std::fs::rename fails when the destination already exists. The initial checkpoint save succeeds, but the first new line changes the state and this rename then fails; the forwarder repeatedly restarts without POSTing that line, effectively disabling configured file-tail delivery on Windows. Use a Windows-compatible atomic replacement primitive while preserving the durable checkpoint semantics.

AGENTS.md reference: AGENTS.md:L25-L25

Useful? React with 👍 / 👎.