fix(storage): enforce sole-daemon database ownership

[ScriptedAlchemy]

Root cause

TraceDecay clients could independently open the same SQLite files through MCP, CLI, hooks, worktrees, maintenance, and fallback paths. Process-local caches, advisory locks, and path-string identity did not establish one cross-process owner, so aliases, restarts, stale locks, and recovery paths could create competing writers or mutate storage while another owner was active.

Design

• Elect and authenticate one lifecycle-scoped daemon as the sole ordinary SQLite owner.
• Route MCP, CLI, hook, automation, and session-start work through the broker on Unix and Windows.
• Require explicit daemon or exclusive-maintenance authority for local database handles.
• Serialize writes, use safe read-only connections, canonicalize database identity, and reject aliases/split-brain ownership.
• Fail closed when the daemon is unavailable; no silent local writable fallback.
• Preserve and validate recovery state, WAL/SHM files, authority epochs, and legacy lock compatibility.
• Add multi-process coverage for concurrent clients, split-brain rejection, daemon restart, and killed-writer WAL recovery.

Verification observed

Passed during development:

• targeted database-access, daemon-authority, daemon-transport, daemon-cache, admin RPC, and doctor regressions
• cargo check --all-targets
• Windows GNU library cross-check
• killed-writer recovery case in the multi-process suite

The first full cargo test --test storage_suite multi_connection -- --nocapture run completed with 1 passed, 2 failed, and 1 ignored. Both failures were harness timeouts: hook subprocess stdin remained open, so EOF-driven hooks waited for the 20-second watchdog. Commit 6a107195 closes stdin after writing.

Post-EOF focused reruns were started but not completed, so there is no claimed passing rerun for that fix. CI is the source of truth for the corrected suite and full matrix.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e6fe9a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a10719569

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".