refactor: remove the on-disk ghost log

[Juliusolsson05]

Fixes #731

Why (owner decision, 2026-09-25)

<userData>/ghost-logs/<sessionId>.ghost.jsonl persisted the renderer's provisional rows, so that a pane which crashed mid-turn could show them after a restart.

• Unused: nothing had read these files since 0cb71e9 (2026-07-16). The only reader looked them up under a freshly minted spawn id (bug(recovery): restored panes never read their ghost log (crash-resume bootstrap dead since July) #1225).
• Costly:
  • 2.1 GB on the owner's machine, with 1,935 of 1,955 files belonging to sessions that no longer existed;
  • one OOM in main (2026-05-11);
  • its own compaction and retention code.
• Hard to revive: reviving the reader (fix(workspace): restored panes read their persisted ghost log #1227, closed) needed clock and identity machinery (the q6 straddle, Codex response ids) to avoid repainting committed turns. That was for a rare case, and the restored text is not in the agent's own resumed conversation.

What goes

• Main: GhostJournal with its startup compaction, the ghost:append / ghost:read IPC, and the shutdown flush.
• Preload: the ghost bridge.
• Renderer:
  • every ghostAppend;
  • the dead spawn-time bootstrap in session.ts;
  • ghostsToPersist.
• Retention: the ghost-logs bucket, and fix(storage): prune orphaned ghost logs; protect a ghost log only while its session exists #1223's owner provider together with WorkspaceFileStore.sessionOwnershipKnown, which existed only for it. sessionIds() stays because it has another caller.

What stays

In-memory ghosts are unchanged: the live streaming preview, and the fallback for JSONL stuck mid-turn while the pane is live. docs/design/ghost-system.md now says crash-resume is deliberately not covered, and explains why.

Cleanup of existing installs

storage/legacyGhostLogs.ts removes the directory in the background on every launch. It is an idempotent rm -rf, and failure is logged and harmless. It can be deleted a few releases after this change ships.

Tests

• New: legacyGhostLogs.test.ts checks that the directory is removed, its siblings are untouched, and a missing directory is a no-op.
• Removed: tests of removed code (journal, owner retention, ownership flag).
• Retargeted: the shutdown diagnostic test now uses the recordings flush. The burst-cadence test asserts the ghost map instead of IPC append counts.
• Suite results:
  • tsc -b is clean.
  • The full suite passes 6,713 of 6,715 (1 skipped). The one failure, src/main/workflows/control.system.test.ts (a 5 s timeout), fails identically on a clean origin/main locally, and main's CI is green. It is local environment, unrelated.

🤖 Generated with Claude Code

Review disposition (A Claude, B Pi; 2 rounds)

Finding	Disposition
A1: ARCHITECTURE.md still described the journal (dead link, crash-resume claims, storage row)	Fixed (dfc1534e)
A2: ghost-system.md contradicted its new "in memory only" section	Fixed
A3/B2: stale comments (devDebug, bundleCorpus, useIpcSubscriptions ×2, SessionFeed, extraction script)	Fixed
A4: unused basename import	Removed
A5/B1/B3: cleanup contracts unpinned (force:false and a removed try/catch survived)	Fixed: quiet-no-op (no warn) and never-rejects tests; both mutants killed
B3b: no tripwire on the startup call site	Accepted (repo norm)
Merge 736e51e9 (#1228 conflict)	Verified by both in round 2: sweepGhosts intact, every persistence call site gone

Round 2: A and B MERGE-READY on dfc1534e. Steering q7 condition met: round 2 and CI both ran on the post-merge head.