fix(storage): publish namespace positions atomically

[HandSonic]

Related issue

N/A - no matching issue was found.

Summary

Namespace datasource-position operations mutated live datasourceIds lists before persistence. A write failure left memory moved/deleted while disk and reload state remained old. This change deep-copies the complete namespace map, persists the candidate first, publishes one volatile map reference, and preserves null namespace as move-to-root.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • Red tests reproduced update/delete divergence and a null-target regression during review.
  • Focused namespace atomic tests: 4 passed.
  • Storage reactor: tools 68, domain API 27, storage 61 passed.
  • Storage package and fork code/CodeQL checks: passed.
  • Merge-tree with fix(storage): publish small mutations after persistence #2830, fix(storage): preserve tree on invalid or failed moves #2816, and fix(storage): roll back failed large mutations #2835: passed.
• Manual verification: N/A - temporary-file fault injection verifies memory, bytes, reload, success, and root movement.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: Existing namespace JSON and request semantics are unchanged.
• Database or driver compatibility: N/A.
• Network, privacy, or security: N/A.
• Community / Local / Pro boundary: Shared Community namespace storage.
• Backward compatibility: Null target still moves a datasource to root; successful ordering remains append-to-target.

Reviewer map

• Start here: NamespaceStorage.copyDataMap/persistPositions and atomic-write tests.
• Failure condition: a failed write changes live objects, or null target throws instead of moving to root.
• Rollback or disable path: Revert commit 25ada3b790c0649857cb733aa4caa792f4ccb2ef; no migration is required.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: OpenAI Codex assisted with diagnosis, implementation, deterministic tests, verification, and adversarial review.

Latest-main revalidation (2026-09-04)

• Rebased onto upstream 144a04e; current head 25ada3b.
• Full storage module: 61/61 passed.