fix(telemetry): clear recall store and legacy tee logs on forget

[yeahjack]

Summary

• Make rtk telemetry forget erase both the SQLite recall store and legacy tee spool, regardless of the current recovery mode or write-disable switches. Each backend reuses its existing path resolver, including environment overrides, configured paths, and migrated [tee] settings.
• Remove only the selected recall database and its -wal, -shm, and -journal sidecars, plus top-level RTK-shaped tee filenames. Preserve unrelated files/directories, tolerate missing stores, refuse file symlinks, and report partial cleanup failures while attempting both backends.
• Close the current process's cached SQLite connection and refuse a busy store through an exclusive-lock probe. Document that other RTK commands must be stopped: closing the probe before unlinking is required on Windows, so this is not an atomic cross-process erasure barrier or a secure-disk-erasure guarantee.

Closes #1789. Implements the current-retriever follow-up invited in #2798 (comment). The tracking database override change in #3044 remains separate.

Design and scope

The backend modules own cleanup; the telemetry command coordinates erasure and reports failures. An unreadable/malformed config fails before overwriting configured paths with defaults. No dependencies or command-output hot paths change.

The tee scope follows the existing writer's <epoch>_<sanitized-slug>.log format, including older unshortened slugs. Configuration and nonmatching files remain. Erasure removes current recovery data; rtk config recall disabled separately prevents future recovery writes.

Test plan

• cargo fmt --all --check
• cargo clippy --all-targets
• cargo test --all: 4,390 passed, 8 pre-existing ignored tests not run
• cargo doc --no-deps
• bash scripts/check-test-presence.sh origin/develop
• 15 focused regression tests: default/config/env/legacy paths, disabled recovery, cached connections, orphan sidecars, repeat/missing cleanup, unrelated files/subdirectories, symlink refusal, invalid/empty paths, partial failures, and busy WAL readers/writers with retry after release
• Built-CLI smoke test with synthetic temporary data: a second process holding a WAL write transaction causes a nonzero exit and preserves database/WAL while tee cleanup proceeds; after it closes, erase and repeat succeed. Override precedence and unrelated-file preservation verified.

Local verification ran on Linux. All destructive tests use disposable fixtures.

CI run 38304221436 passed for 102b6b73791942ea42aa6ad82206e648fbb2af83, including Linux/macOS/Windows tests, formatting, clippy, rustdoc, benchmark, and security scans. CLA passed. The target-branch check is intentionally skipped for develop; the optional AI documentation review was skipped because its repository API key is not configured (the job reports success).

[rtk-wshm-sync-bot]

wshm · Automated triage by AI

📊 Automated PR Analysis

🐛 Type	bug-fix
🟡 Risk	medium

Summary

This PR extends rtk telemetry forget to erase both the SQLite recall store and legacy tee spool, regardless of current recovery mode or write-disable settings, reusing each backend's existing path resolver. It carefully scopes deletion to recall DB files and their SQLite sidecars plus RTK-shaped tee filenames, refuses symlinks, closes cached connections, and detects busy stores via an exclusive-lock probe, while documenting that it is not an atomic cross-process erasure barrier.

Review Checklist

• Tests present
• Breaking change
• Docs updated

Linked issues: #1789

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.