@chance722/dsh-inbox 0.2.6 → 0.2.7

package/README.md

@@ -6,45 +6,41 @@ A **local inbox plugin for [DeepSeek Harness](https://github.com/deepseek-ai/dee
 
 English | [中文](README.zh.md)
 
-## The problem it solves
+## What it is
 
-The things you copy during a day — a link to read later, a screenshot, a snippet of config, an account and password — end up scattered across clipboard history, bookmark folders and temporary files. When you need them you cannot find them, and you cannot remember where they went.
+The things you copy in a day — a link to read later, a screenshot, a config snippet, an account and password — end up scattered across clipboard history, bookmarks and temp files. dsh-inbox keeps them in one local vault: paste to file, automatic classification, browse and search from the sidebar — and instead of digging through it yourself, ask your assistant "what was that article about caching I saved last month?".
 
-**dsh-inbox puts them in one local vault**: paste to file, automatic classification, browse and search from the sidebar — and instead of digging through it yourself, just ask your assistant "what was that article about caching I saved last month?".
-
-It works for you alone: everything lands on your machine, and the model only sees a record when you ask it to look.
+Everything lands on your machine, and the model only sees a record when you ask it to look.
 
 ## Features
 
 | Feature | What it does |
 |---|---|
 | **Two ways in** | `/inbox <text or link>` in the composer (attach images to carry them along), or paste / drop / pick a file in the panel |
-| **Automatic classification** | Links are filed by platform and media type (Bilibili/YouTube videos, WeChat/掘金/Zhihu articles — 60-odd sites), text by credential shape, images get a 疑似证件 tag when they have card proportions; what the rules cannot decide goes to the model, with a daily cap |
-| **Panel** | Filter by watch-later / category / tag, search across title, text, link and note, switch between two list densities; the detail pane edits name, category, note and tags, flags watch-later, deletes and restores; it follows dsh's dark and light themes **and its language** (switch dsh to English under 设置 → 常规 and the whole panel, dock, cards and manual come with you) |
-| **Everything has a name** | A link is named by the headline of the page it points at (no model tokens spent), a photo or file by the name it arrived with, and the name you type always wins. A page that will not be read — an anti-bot page, a dead link — leaves the address itself as the name rather than a guess. The row shows the name; the glyph on the left says what kind of thing it is (a key for a credential) |
-| **Who judged the category** | A coloured badge next to the category: 规则判定 (grey, the local rules) / 模型判定 (violet, the capped model pass) / 手动判定 (blue, your own choice — nothing overwrites it later) |
-| **Ask in conversation** | Ask for 收件箱 / 仓库 / inbox and the assistant searches by words, category, tag, watch-later flag or kind (ten at a time plus a count of the rest, with thumbnails right in the results), then opens one by id (text up to 1000 characters, link, note, tags, attachment facts). To look at one yourself: expand 「N 次工具调用」 above the answer and press 打开 ↗ — the 仓库 tab opens on that record |
-| **Looking at a picture** | Image bytes stay out of the conversation by default; when you ask "look at this picture and tell me what it is", the assistant sends that one image to itself — explicitly, per call |
-| **Credentials are safe** | A credential's body is **encrypted at rest** with a key derived from your master password; neither the password nor the key is ever written down. The list shows only the name you gave it; plain text never reaches a conversation or a model |
-| **Two-way sync** | Point it at a WebDAV folder or an S3 bucket: changes are pushed a few seconds after you make them, 刷新 runs a full sync (push, then pull, merged per record by `id` + timestamp), and emptying the recycle bin deletes the cloud copies too. Two machines see each other when they share one 「目录」 (blank, `/` and `inbox` are the same) |
-| **Conversation cards** | Tool results render as dsh-inbox cards — links become clickable, image markers become thumbnails drawn on your machine |
-| **Gateway quirks** | Some object-storage gateways bind each AccessKey to an "application" and identify clients by a header (refusing you with the same status a wrong password gets) — the plugin keeps **one client identity per protocol** for exactly that |
+| **Automatic classification** | Links by platform and media type (60-odd sites: Bilibili, YouTube, WeChat, 掘金, Zhihu…), text by credential shape, images get a 疑似证件 tag at card proportions; the rest goes to the model, with a daily cap |
+| **Panel** | Filter by watch-later / category / tag, search title, text, link and note, two list densities; the detail pane edits name, category, note and tags, flags watch-later, deletes and restores — and it follows dsh's theme **and language** |
+| **Every record has a name** | A link takes the page's own headline (no model tokens), a photo or file its file name, and the name you type always wins. A page that will not be read — an anti-bot page, a dead link — leaves the address as the name rather than a guess |
+| **Who judged the category** | A coloured badge: 规则判定 (local rules) / 模型判定 (the capped model pass) / 手动判定 (yours — nothing overwrites it later) |
+| **Ask in conversation** | Ask for 收件箱 / 仓库 / inbox and the assistant searches by words, category, tag, watch-later flag or kind (ten at a time plus a count, thumbnails inline) and opens one by id (text up to 1000 characters, link, note, tags, attachments). 「打开 ↗」 under an answer jumps to that record in the 仓库 tab |
+| **Looking at a picture** | Image bytes stay out of the conversation; ask the assistant to look at one and that single image is sent — explicitly, per call |
+| **Credentials are safe** | The body is encrypted at rest, with a key derived from your master password — neither is ever written down. The list shows only the name you gave it, and plain text never reaches a conversation or a model |
+| **Two-way sync** | Point it at a WebDAV folder or an S3 bucket: changes push a few seconds later, 刷新 runs a full push-then-pull merged per record by `id` + timestamp, and emptying the recycle bin deletes the cloud copies too. Two machines see each other when they share one 「目录」 |
+| **Conversation cards** | Tool results render as dsh-inbox cards — links clickable, image markers drawn as thumbnails on your machine |
+| **Gateway quirks** | Some object-storage gateways bind each AccessKey to an "application" and identify clients by a header — so the plugin keeps **one client identity per protocol** |
 
 ## Screenshots
 
-![The panel: filters on the left, list in the middle, detail on the right](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/panel.png)
-
-It all lives inside dsh: the left rail gains an **Inbox** entry that opens a full-page vault, and the panel's top right has 设置 (settings) and 使用手册 (a short manual).
+![The panel: filters on the left, list in the middle, detail on the right](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/panel.png?v=1)
 
 ## Two ways to use it
 
 **① File something from the conversation**
 
-Type `/inbox` in the composer followed by text or a link, and attach images directly — **this command never reaches the model**, it only goes into the vault. It is the way to file credentials and throwaway links that have no business appearing in a conversation.
+`/inbox` in the composer, followed by text or a link, with images attached right there — **this never reaches the model**, it only goes into the vault. That is the way to file credentials and throwaway links.
 
 **② Ask for it later**
 
-No command needed, just talk:
+No command, just talk:
 
 > which of my saved images is the mini-program code?
 >
@@ -54,46 +50,33 @@ No command needed, just talk:
 
 Two questions in the same conversation, on a real machine:
 
-![Searching by topic: the one match first, then all seven records — the two credentials show only the names their owner gave them, never the plain text](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat1.png)
+![Searching by topic — the two credentials show only their names](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat1.png)
 
-![Asking for what is flagged watch-later: that one record comes back with its link and the time it was filed](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat2.png)
+![Asking for what is flagged watch-later](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat2.png)
 
 ## Install
 
-Needs Node ≥ 22 and a working `dsh`. `dsh plugin add` forwards to pnpm, so the installer brings pnpm along when your machine does not have it:
-
-**Platform**: fully accepted on **Windows** only so far; macOS and Linux are **not verified yet** (no platform-specific dependency in the code — try it and tell me how it goes).
-
-`dsh web` is just `dsh --profile web`, so install into the profile you already start:
+Needs Node ≥ 22 and a working `dsh`; the installer brings pnpm along when your machine does not have it. **Windows only so far** — macOS and Linux are unverified.
 
 ```powershell
+# install (`dsh web` is `dsh --profile web`, so this is the profile you already start)
 npx @chance722/dsh-inbox init --profile web --install-pnpm
-```
-
-Then start dsh the way you always do — `dsh web`. The **Inbox** entry is in the left rail, and a new session's assistant can look things up for you ("what links in my inbox haven't I read yet?").
-
-On a machine that has never run dsh there is no `web` profile yet; `--create-profile` makes it first:
 
-```powershell
+# never run dsh on this machine? create the profile in the same command
 npx @chance722/dsh-inbox init --profile web --create-profile --install-pnpm
-```
-
-`init` does three things, and running it twice is safe:
 
-1. installs the plugin into that profile — the panel and the host half both come from here
-2. copies dsh's shipped `standard` preset into `~/.dsh/.agent-presets/inbox/` and adds this plugin — **this is the step that decides whether the assistant can see the inbox tools**
-3. points your user-level default preset at it (backing up `~/.dsh/settings.yaml` first), so new sessions in every profile get those tools
+# update (init only installs and wires things up — re-running it never upgrades;
+# minutes after a release, write the exact version instead: @0.2.7)
+dsh plugin --profile web add @chance722/dsh-inbox@latest
+```
 
-Two things that changes, so you know: the plugin joins the profile you named, and your default agent preset becomes the 收件箱 copy — a snapshot of `standard` that will not follow later dsh upgrades. Both are reversible (see Uninstall).
+**Restart dsh** afterwards, then start it as usual. **Inbox** is in the left rail, and a new session's assistant can look things up ("what links in my inbox haven't I read yet?").
 
-**Want to keep your daily dsh clean?** Give the plugin a profile and a port of its own:
+`init` also copies dsh's shipped `standard` preset to `~/.dsh/.agent-presets/inbox/` with this plugin added, and points your default preset at it — that is what lets the assistant see the inbox tools. It becomes a snapshot that will not follow later dsh upgrades; both it and the profile are reversible (see Uninstall).
 
-```powershell
-npx @chance722/dsh-inbox init --create-profile     # an isolated `inbox` profile
-dsh --profile inbox --no-open --port 3102          # start it there
-```
+To keep your daily dsh untouched, give the plugin its own profile and port: `npx @chance722/dsh-inbox init --create-profile`, then `dsh --profile inbox --no-open --port 3102`.
 
-Other flags: `--profile <name>` installs elsewhere, `--install-pnpm` installs pnpm first when it is missing (the two commands above already carry it), `--no-default` leaves the default preset alone, `--help` lists everything. Which profile you install into only decides **where the panel runs** — the agent preset is shared by every profile (`~/.dsh/.agent-presets/inbox/`), so installing into a second one just fills in the missing row.
+Other flags: `--profile <name>`, `--install-pnpm`, `--no-default`, `--help`.
 
 ### From a local checkout
 
@@ -123,7 +106,7 @@ rm -r ~/.dsh/profiles/<that profile>
 
 ## Where things live
 
-All of it on your machine (`%DSH_HOME%`, i.e. `C:\Users\<you>\.dsh` on Windows):
+Everything under `%DSH_HOME%` (`C:\Users\<you>\.dsh` on Windows):
 
 | What | Where |
 |---|---|
@@ -148,20 +131,20 @@ With a remote configured and `/inbox` as the directory:
 
 ### How syncing works
 
-- **Automatic**: a push goes out a few seconds after a capture or an edit (debounced — several quick saves become one push). 「刷新」 is a full sync: push → pull → re-read the list.
-- **Merging**: incoming records are settled one by one by `id` + timestamp — the newer write wins, no conflict copies. Attachment bytes come down when a record needs them.
-- **Two machines**: they see each other when both use the same 「目录」 (blank, `/` and `inbox` all mean the same directory). Records a machine left under an older directory can be pulled in by ticking **Merge other sync directories too** in the settings.
-- **Deleting**: 「删除」 only moves a record to the bin, and other devices learn it is gone instead of pushing it back; emptying the bin is what deletes the cloud copy as well.
+- **Automatic**: a push seconds after a capture or edit (debounced — several quick saves are one push); 「刷新」 is a full sync: push → pull → re-read the list.
+- **Merging**: per `id` + timestamp, the newer write wins, no conflict copies; needed attachment bytes come down with the record.
+- **Two machines**: one shared 「目录」 (blank, `/` and `inbox` are the same). Records a machine left under an older directory come back if you tick **Merge other sync directories too** in the settings.
+- **Deleting**: 「删除」 only moves a record to the bin and the other devices are told it is gone; emptying the bin deletes the cloud copy as well, and it stays deleted — a copy sitting in another sync directory cannot file it back in.
 
 ## Privacy and security
 
-- **Credentials are encrypted at rest**: the body is stored as ciphertext (AES-256-GCM, key derived from your master password). **Neither the password nor the key is ever written down** — the vault locks again on every restart and you unlock it under 设置 → 账密加密; a forgotten password means unrecoverable ciphertext. With no master password set, a credential is **refused rather than stored in the clear**.
-- **What that covers**: only the **body** of credential records. Notes, categories, tags, timestamps and attachment **bytes** are not encrypted — a key inside a pasted file is still a key inside a file.
+- **Credential bodies are encrypted at rest** (AES-256-GCM, key derived from your master password). Neither the password nor the key is written down: the vault locks on every restart and you unlock it under 设置 → 账密加密, and a forgotten password means unrecoverable ciphertext. With no master password set, a credential is **refused rather than stored in the clear**.
+- **That covers the body only**: notes, categories, tags, timestamps and attachment **bytes** are not encrypted — a key inside a pasted file is still a key inside a file.
 - **Masked where it matters**: a credential is listed by the name you gave it, and its plain text never reaches a conversation or a model.
-- **Pictures**: classification does send an image to the model (a phone photo of an ID card has the same proportions as any other photo); the conversation gets an `[attachment:id]` marker by default. **The one exception**: when you explicitly ask the assistant to look at a picture, that single image is sent to it — per call, never by default.
+- **Pictures**: classification does send an image to the model, and the conversation gets an `[attachment:id]` marker — that one image is sent only when you explicitly ask the assistant to look at it.
 - **The model cannot see your vault** unless you ask it to look, and classification requests are redacted first.
 - **Your remote needs access control**: only credential bodies are ciphertext up there — text, links, notes and attachment bytes are in the clear, and the master password and key never sync.
-- **What the install changes outside the panel**: reading a pasted link's headline is this plugin's only outbound request — one GET, only for links captured on this machine, never for links that arrived through sync. The profile makes it with a browser-shaped identity (`… AppleWebKit/537.36 (KHTML, like Gecko) dsh-inbox Safari/537.36`), shipped in this package's `cordis.patch.yml` as an override of `web-fetch-http.userAgent`, because sites gate on the shape of that string. That identity is the whole profile's, the model's own web tools included; **your own `cordis.patch.yml` overrides it**. Measurements and reasoning: [docs/help/link-title-fetch.md](docs/help/link-title-fetch.md).
+- **One thing the install changes outside the panel**: reading a pasted link's headline is the plugin's only outbound request (one GET, only for links captured on this machine, never for links that came through sync). It goes out with a **browser-shaped** identity, an override of `web-fetch-http.userAgent` shipped in this package's `cordis.patch.yml`. That identity is the whole profile's, the model's own web tools included; **your own `cordis.patch.yml` overrides it**. Details: [docs/help/link-title-fetch.md](docs/help/link-title-fetch.md).
 
 ## Development
 
@@ -172,7 +155,7 @@ pnpm typecheck
 pnpm test         # vitest
 ```
 
-Client-side changes need `pnpm build` and a page reload (dsh's client-hmr reloads it for you); host-side changes need a restart. Details in [docs/help/dev-setup.md](docs/help/dev-setup.md); milestones and acceptance records in the [development bus](docs/feature/dev-bus.md).
+Client-side changes need `pnpm build` (dsh's client-hmr reloads the page); host-side changes need a restart. Details in [docs/help/dev-setup.md](docs/help/dev-setup.md), milestones in the [development bus](docs/feature/dev-bus.md).
 
 To switch the profile you actually run between the **published package** and **this checkout** (default profile `web`; set `DSH_PROFILE` for another):
 

package/README.zh.md

@@ -6,41 +6,37 @@
 
 [English](README.md) | 中文
 
-## 它解决什么问题
+## 它是什么
 
-一天里复制过的东西——一条待读的链接、一张截图、一段配置、一个账号密码——散落在剪贴板历史、收藏夹和临时文件里，要用的时候找不到，也记不住放在哪。
+一天里复制过的东西——一条待读的链接、一张截图、一段配置、一个账号密码——散落在剪贴板历史、收藏夹和临时文件里。dsh-inbox 把它们收进一个本地仓库：粘贴即存、自动分类、侧栏里能翻能搜；要找回什么，直接问助手「我上个月存的那篇讲缓存的文章呢」。
 
-**dsh-inbox 把它们收进一个本地仓库**：粘贴即存、自动分类、侧栏里能翻能搜；想找的时候不必自己翻，直接在对话里问助手「我上个月存的那篇讲缓存的文章呢」。
-
-它只服务于你自己：数据全部落在本机，只有你让助手查的时候，模型才看得到内容。
+数据全部落在本机；只有你让助手查的时候，模型才看得到内容。
 
 ## 主要功能
 
 | 功能 | 说明 |
 |---|---|
 | **两个入口** | 输入框里 `/inbox <文字或链接>`（图片附在输入框上一起收），或面板里粘贴 / 拖拽 / 选择文件 |
-| **自动分类** | 链接按平台与类型分（B 站/YouTube 视频，公众号/掘金/知乎文章…共 60 多个站点）、文本按密钥形状分、图片按比例加「疑似证件」标签；规则判不出的交给模型兜底，有每日上限 |
-| **面板** | 待看 / 类目 / 标签筛选 + 跨标题正文链接备注的搜索；两种列表密度；详情里能改名称、类目、备注、标签，能标待看，能删除与恢复；**跟着 dsh 的深色/浅色主题走，也跟着它的语言走**（在「设置 → 常规」里把 dsh 切成 English，面板、右侧 dock、对话卡片与使用手册一起变） |
-| **每条都有名字** | 链接自动抓页面标题（不花模型 token）、图片文件用原文件名；你自己起的名字永远优先。读不到的页面——对方是反爬页、或者链接已经死了——名字位就留链接本身，不猜一个。列表里显示名字本身，类型交给左侧图标（密钥就是一把钥匙） |
-| **类目是谁判的** | 类目旁带颜色标签：规则判定（灰）/ 模型判定（紫）/ 手动判定（蓝）。你改过的类目，后续任何流程都不会覆盖 |
-| **对话里取回** | 直接问「我的收件箱 / 仓库 / inbox 里有哪些还没看的链接」就行，助手按关键词/类目/标签/待看/类型查（最多 10 条 + 还剩几条，带图的结果直接显示缩略图），按 id 打开一条（正文最多 1000 字、链接、备注、标签、附件信息）。想直接看某一条：展开回答上方的「N 次工具调用」，记录后面的「打开 ↗」会在右侧「仓库」里停到那一条 |
-| **看图** | 默认图片字节不进对话；你说「帮我看这张图是什么」时，助手才会把那张图发给自己看（一次性、显式要） |
-| **密钥安全** | 账密正文**加密落盘**：主密码派生密钥，密码与密钥都不落盘；列表只显示你起的名字；明文永不进对话、永不发给模型 |
-| **双向同步** | 配一个 WebDAV 目录或 S3 桶：入库后自动推送，点「刷新」做一次完整同步（先推后拉、按记录 `id` + 时间合并），清空回收站连云端一起删；两台机器用同一个「目录」就能互通（留空 / `/` / `inbox` 同义） |
-| **对话卡片** | 工具结果渲染成 dsh-inbox 卡片：链接可点，图片标记在本机渲染成缩略图 |
-| **网关兼容** | 有些对象存储网关把每把 AccessKey 绑在"应用"上并按客户端标识认人（状态码与"密码错"一样）——插件支持**按协议各存一份客户端标识** |
+| **自动分类** | 链接按平台与类型分（60 多个站点：B 站、YouTube、公众号、掘金、知乎…）、文本按密钥形状分、图片按比例加「疑似证件」标签；规则判不出的交给模型兜底，有每日上限 |
+| **面板** | 待看 / 类目 / 标签筛选 + 跨标题正文链接备注的搜索；两种列表密度；详情里能改名称、类目、备注、标签，能标待看、删除与恢复；**跟着 dsh 的主题和语言走** |
+| **每条都有名字** | 链接抓页面自己的标题（不花模型 token）、图片文件用原文件名，你自己起的名字永远优先。读不到的页面——反爬页、死链——名字位留链接本身，不猜一个 |
+| **类目是谁判的** | 类目旁的颜色标签：规则判定 / 模型判定 / 手动判定（你改过的，后续不会覆盖） |
+| **对话里取回** | 问「我的收件箱 / 仓库 / inbox 里有哪些还没看的链接」即可，助手按关键词/类目/标签/待看/类型查（最多 10 条 + 还剩几条，带图的直接显示缩略图），按 id 打开一条（正文最多 1000 字、链接、备注、标签、附件信息）；回答上方的「打开 ↗」会跳到右侧「仓库」里那一条 |
+| **看图** | 默认图片字节不进对话；你说「帮我看这张图是什么」时，才会把那一张发给自己看（一次性、显式要） |
+| **密钥安全** | 账密正文**加密落盘**（主密码派生密钥，两者都不落盘）；列表只显示你起的名字；明文永不进对话、永不发给模型 |
+| **双向同步** | 配 WebDAV 目录或 S3 桶：改动后几秒自动推送，「刷新」= 先推后拉完整同步、按 `id` + 时间合并；清空回收站连云端一起删；两台机器用同一个「目录」就互通 |
+| **对话卡片** | 工具结果渲染成卡片：链接可点，图片标记在本机渲染成缩略图 |
+| **网关兼容** | 有些对象存储网关把 AccessKey 绑在「应用」上、按客户端标识认人——插件**按协议各存一份客户端标识** |
 
 ## 界面
 
-![面板：左侧筛选、中间列表、右侧详情](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/panel.png)
-
-界面都在 dsh 里：左侧栏多一个 **Inbox** 入口，点开是整页仓库管理；面板右上角有「设置」和「使用手册」（手册把常见场景讲了一遍）。
+![面板：左侧筛选、中间列表、右侧详情](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/panel.png?v=1)
 
 ## 两种用法
 
 **① 存：在对话里转存**
 
-输入框里写 `/inbox` 再跟文字或链接，图片直接附在输入框上——**这条命令不会发给模型**，只进仓库。适合存账号密码、临时链接这类不该出现在对话里的东西。
+输入框里写 `/inbox` 再跟文字或链接，图片直接附在输入框上——**这条命令不会发给模型**，只进仓库。适合存账号密码、临时链接这类东西。
 
 **② 取：在对话里问**
 
@@ -54,46 +50,32 @@
 
 同一段对话里的两次提问（真机截图）：
 
-![按主题查仓库：助手先给命中的那一条，再把 7 条记录列成表——密钥那两行只显示你起的名字，没有明文](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat1.png)
+![按主题查仓库——密钥那两行只显示你起的名字](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat1.png)
 
 ![问「有没有待看的」：按「待看」标记把那一条取回来，带链接与存入时间](https://raw.githubusercontent.com/Chance722/dsh-inbox/main/docs/assets/chat2.png)
 
 ## 安装
 
-前置：Node ≥ 22，以及一个能用的 `dsh`。`dsh plugin add` 是转发给 pnpm 的，所以机器上没有 pnpm 时，安装命令会顺手替你装好：
-
-**平台**：目前只在 **Windows** 上做过完整验收；macOS / Linux **尚未验证**（代码里没有平台特定依赖，欢迎试用后反馈）。
-
-`dsh web` 就是 `dsh --profile web`，所以直接装进你日常启动的那个 profile：
+前置：Node ≥ 22 和一个能用的 `dsh`；没装 pnpm 时安装命令会顺手装好。**目前只在 Windows 上验收过**，macOS / Linux 未验证。
 
 ```powershell
+# 安装（`dsh web` 就是 `dsh --profile web`，所以装进你日常启动的那个 profile）
 npx @chance722/dsh-inbox init --profile web --install-pnpm
-```
-
-然后照旧启动——`dsh web`。左栏出现 **Inbox**；新会话里问「我的收件箱里有哪些还没看的链接」，助手就会去查。
-
-全新机器（从没跑过 dsh，还没有 `web` 这个 profile）加 `--create-profile` 让它先建：
 
-```powershell
+# 全新机器（还没跑过 dsh、没有这个 profile）多带一个 --create-profile
 npx @chance722/dsh-inbox init --profile web --create-profile --install-pnpm
-```
-
-`init` 做三件事，重复运行是安全的：
 
-1. 把插件装进这个 profile——面板和宿主半边都从这里来
-2. 复制 dsh 自带的 `standard` preset 到 `~/.dsh/.agent-presets/inbox/` 并加入本插件——**这一步决定助手能不能看到收件箱工具**
-3. 把你**用户级**的默认 preset 指向它（会先备份 `~/.dsh/settings.yaml`），于是所有 profile 的新会话都带上这套工具
+# 更新（init 只管装和接线，重复跑不会升级；刚发布的几分钟内请写确切版本：@0.2.7）
+dsh plugin --profile web add @chance722/dsh-inbox@latest
+```
 
-有两件事跟你的设置有关，先说清楚：插件会进你点名的那个 profile；你的默认 agent preset 变成「收件箱」那份——**它是 `standard` 的副本快照，dsh 以后升级 standard 不会自动跟着变**。两件都能退（见「卸载」）。
+装完**重启 dsh**，然后照旧启动。左栏出现 **Inbox**；新会话里问「我的收件箱里有哪些还没看的链接」，助手就会去查。
 
-**想让日常 dsh 保持干净？** 给插件单独一个 profile 和端口：
+`init` 还会把 dsh 自带的 `standard` preset 复制到 `~/.dsh/.agent-presets/inbox/` 并加上本插件、把默认 preset 指向它——助手能看见收件箱工具就是靠这一步。那份快照不会跟着 dsh 以后升级 `standard` 一起变；它和 profile 都能退掉（见「卸载」）。
 
-```powershell
-npx @chance722/dsh-inbox init --create-profile     # 建一个隔离的 inbox profile
-dsh --profile inbox --no-open --port 3102          # 在那个 profile 里起
-```
+想让日常 dsh 保持干净：`npx @chance722/dsh-inbox init --create-profile`，然后 `dsh --profile inbox --no-open --port 3102`。
 
-其它选项：`--profile <名字>` 装到别处，`--install-pnpm` 在没有 pnpm 时先替你装（上面两条命令已经带上它），`--no-default` 不动默认 preset，`--help` 列全。装进哪个 profile 只决定**面板跑在哪儿**——agent preset 是所有 profile 共享的（`~/.dsh/.agent-presets/inbox/`），装第二个 profile 只会补上缺的那行。
+其它选项：`--profile <名字>`、`--install-pnpm`、`--no-default`、`--help`。
 
 ### 从本地仓库装
 
@@ -122,7 +104,7 @@ rm -r ~/.dsh/profiles/<你装的 profile>
 
 ## 东西存在哪
 
-全部在本机（`%DSH_HOME%`，Windows 上就是 `C:\Users\<你>\.dsh`）：
+全部在 `%DSH_HOME%` 下（Windows 上就是 `C:\Users\<你>\.dsh`）：
 
 | 什么 | 在哪 |
 |---|---|
@@ -147,20 +129,20 @@ rm -r ~/.dsh/profiles/<你装的 profile>
 
 ### 同步怎么走
 
-- **自动**：入库或改动后几秒推一次（防抖，连着存几条只推一次）；「刷新」= 一次完整同步（先推 → 再拉 → 重读列表）。
-- **合并**：拉回来的记录按 `id` + 更新时间逐条判——谁新谁赢，不留冲突副本；需要的附件字节一起下来。
-- **两台机器**：用同一个「目录」就互通（留空 / `/` / `inbox` 是同一个意思）。换过目录的机器留在别处的记录，可以在设置里打开「**同时合并别的同步目录**」一起拉回来。
-- **删除**：「删除」只进回收站，别的设备会知道它被删了（不会又推回来）；「清空回收站」才连云端那份一起删。
+- **自动**：入库或改动后几秒推一次（防抖）；「刷新」= 先推 → 再拉 → 重读列表。
+- **合并**：按 `id` + 更新时间逐条判——谁新谁赢，不留冲突副本；需要的附件字节一起下来。
+- **两台机器**：用同一个「目录」就互通（留空 / `/` / `inbox` 同义）。换过目录的机器留在别处的记录，可以在设置里打开「**同时合并别的同步目录**」一起拉回来。
+- **删除**：「删除」只进回收站，别的设备会知道它被删了；「清空回收站」才连云端那份一起删，而且**清掉就是清掉**——另一套同步目录里那份副本不会再把它塞回来。
 
 ## 隐私与安全
 
-- **账密加密落盘**：账密正文以密文保存（AES-256-GCM，密钥由你设的主密码派生）。**主密码和密钥都不落盘**——服务每次重启都要在「设置 → 账密加密」解锁一次；密码忘了就解不开已有密文，没有找回。没设主密码时，账密**不会被存进去**。
-- **加密的边界**：只加密账密的**正文**。备注、类目、标签、时间与附件的**字节**不在内——附件里装着密钥，它就是明文。别把"账密加密"理解成"整个仓库加密"。
+- **账密加密落盘**：账密正文以密文保存（AES-256-GCM，密钥由主密码派生）。主密码和密钥都不落盘——每次重启都要在「设置 → 账密加密」解锁一次；密码忘了就解不开，没有找回。没设主密码时，账密**不会被存进去**。
+- **加密的边界**：只加密账密的**正文**。备注、类目、标签、时间与附件的**字节**不在内——附件里装着密钥，它就是明文。
 - **列表与对话脱敏**：密钥类记录在列表里只显示你起的名字；明文永不进对话、永不发给模型。
-- **图片**：分类时会把图片发给模型判断（手机拍的证件照比例与普通照片无异）；对话里默认只回 `[attachment:id]` 标记，字节不进对话。**唯一的例外**：你明确让助手「看这张图」时，它会把那一张发给自己看——每次都要显式要求，默认永不发。
+- **图片**：分类时会把图片发给模型判断；对话里默认只回 `[attachment:id]` 标记。只有你明确让助手「看这张图」时，它才会把那一张发给自己看。
 - **模型看不到你的仓库**，除非你让它查（它调工具时才读得到），且分类请求先过脱敏。
 - **云端要有访问控制**：同步上去的内容里只有账密正文是密文，其余（文本、链接、备注、附件字节）是明文；主密码与密钥从不同步。
-- **装它会改到面板之外的一处**：抓链接标题是本插件唯一的对外请求——一次 GET，只在本机捕获的链接上发，同步拉进来的链接不抓。抓取身份是**浏览器形状**（`… AppleWebKit/537.36 (KHTML, like Gecko) dsh-inbox Safari/537.36`），由本包的 `cordis.patch.yml` 覆盖 `web-fetch-http.userAgent` 写成，因为站点按这个字符串的**形状**认客户端。这层身份是整个 profile 的，模型的 web 工具也一起用；**你自己的 `cordis.patch.yml` 覆盖得掉**。实测与理由见 [docs/help/link-title-fetch.md](docs/help/link-title-fetch.md)。
+- **装它会改到面板之外的一处**：抓链接标题是本插件唯一的对外请求（一次 GET，只在本机捕获的链接上发，同步拉进来的不抓）。它用的是**浏览器形状**的身份，由本包的 `cordis.patch.yml` 覆盖 `web-fetch-http.userAgent` 写成。这层身份是整个 profile 的，模型的 web 工具也一起用；**你自己的 `cordis.patch.yml` 覆盖得掉**。细节见 [docs/help/link-title-fetch.md](docs/help/link-title-fetch.md)。
 
 ## 开发
 
@@ -171,7 +153,7 @@ pnpm typecheck
 pnpm test         # vitest
 ```
 
-改客户端代码：`pnpm build` 后刷新页面即可（dsh 的 client-hmr 会自己重载）；改宿主代码要重启服务。细节见 [docs/help/dev-setup.md](docs/help/dev-setup.md)，阶段与验收记录在[开发总线](docs/feature/dev-bus.md)。
+改客户端代码：`pnpm build` 后页面会自己重载（dsh 的 client-hmr）；改宿主代码要重启服务。细节见 [docs/help/dev-setup.md](docs/help/dev-setup.md)，阶段记录在[开发总线](docs/feature/dev-bus.md)。
 
 日常想在**线上发布版**和**本地改动**之间切换（默认 profile 是 `web`，换 profile 加 `DSH_PROFILE`）：
 

package/lib/cli.js

@@ -327,6 +327,7 @@ ${hint}`);
   \xB7 \u7528\u4F60\u5E73\u65F6\u90A3\u6761\u547D\u4EE4\u542F\u52A8\u5B83\uFF1A${profile === "web" ? "dsh web" : `dsh --profile ${profile}`}
   \xB7 \u65B0\u5EFA\u4E00\u4E2A\u4F1A\u8BDD\uFF0C\u5B83\u5C31\u4F1A\u5E26\u4E0A\u6536\u4EF6\u7BB1\u5DE5\u5177\uFF1B\u60F3\u8BA9\u52A9\u624B\u67E5\u4ED3\u5E93\uFF0C\u76F4\u63A5\u95EE\u300C\u6211\u7684\u6536\u4EF6\u7BB1\u91CC\u6709\u54EA\u4E9B\u8FD8\u6CA1\u770B\u7684\u94FE\u63A5\u300D
   \xB7 \u9762\u677F\uFF08\u4FA7\u680F Inbox\uFF09\u4E0D\u9700\u8981 preset\uFF0C\u88C5\u5B8C\u5C31\u5728
+  \xB7 \u4EE5\u540E\u8981\u66F4\u65B0\u5230\u7EBF\u4E0A\u6700\u65B0\u7248\uFF1Adsh plugin --profile ${profile} add ${PACKAGE_NAME}@latest\uFF08\u91CD\u590D\u8DD1 init \u53EA\u4F1A\u91CD\u590D\u68C0\u67E5\uFF0Cpnpm \u56DE\u4E00\u53E5 "Already up to date"\uFF0C\u4E0D\u4F1A\u5347\u7EA7\uFF09
 `
   );
   return 0;

package/lib/client.js

@@ -869,6 +869,7 @@ window.__ModuleLoader__.load({
 		  "sync.detailPulled": "\u62C9\u53D6 {count} \u6761 \xB7 \u4E91\u7AEF {records} \u6761\u8BB0\u5F55 / {files} \u4E2A\u9644\u4EF6",
 		  "sync.detailAdded": "\uFF08\u5176\u4E2D {count} \u6761\u662F\u65B0\u8BB0\u5F55\uFF09",
 		  "sync.detailDeleted": "\uFF08\u5176\u4E2D {count} \u6761\u662F\u5220\u9664\uFF0C\u4F1A\u8FDB\u56DE\u6536\u7AD9\uFF09",
+		  "sync.detailPurged": "\uFF08\u6E05\u7A7A\u8FC7 {count} \u6761\uFF1A\u4E91\u7AEF\u7684\u65E7\u526F\u672C\u6CA1\u6709\u62C9\u56DE\u6765\uFF09",
 		  "sync.pullForeignSync": " \xB7 \u26A0\uFE0F \u53E6\u6709 {records} \u6761\u8BB0\u5F55\u5728\u522B\u7684\u540C\u6B65\u76EE\u5F55\uFF1A{roots}",
 		  "sync.detailForeign": " \xB7 \u26A0\uFE0F \u522B\u7684\u540C\u6B65\u76EE\u5F55\uFF1A{roots}\uFF08{records} \u6761\u8BB0\u5F55\uFF1B\u672C\u673A {ours}\uFF09",
 		  // The toast: two numbers, nothing else. Everything else about a sync is
@@ -1132,6 +1133,7 @@ window.__ModuleLoader__.load({
 		  "sync.detailPulled": "pulled {count} \xB7 the cloud holds {records} records / {files} attachments",
 		  "sync.detailAdded": " ({count} of them new)",
 		  "sync.detailDeleted": " ({count} of them deletions \u2014 they land in the recycle bin)",
+		  "sync.detailPurged": " ({count} emptied out of the bin: their older cloud copies stayed out)",
 		  "sync.pullForeignSync": " \xB7 \u26A0\uFE0F {records} records live in another sync directory: {roots}",
 		  "sync.detailForeign": " \xB7 \u26A0\uFE0F another sync directory: {roots} ({records} records; ours is {ours})",
 		  "sync.shortPushed": "pushed {count}",
@@ -3298,7 +3300,8 @@ window.__ModuleLoader__.load({
 		  });
 		  const gained = (result.added ?? 0) === 0 ? "" : t("sync.detailAdded", { count: result.added ?? 0 });
 		  const deleted = (result.deletions ?? 0) === 0 ? "" : t("sync.detailDeleted", { count: result.deletions ?? 0 });
-		  return `${head}${gained}${deleted}${warningsOf(result, true)}`;
+		  const purged = (result.purged ?? 0) === 0 ? "" : t("sync.detailPurged", { count: result.purged ?? 0 });
+		  return `${head}${gained}${deleted}${purged}${warningsOf(result, true)}`;
 		}
 		function EncryptionSettings({ call }) {
 		  const [status, setStatus] = import_react8.default.useState();

package/lib/index.js

@@ -3,7 +3,7 @@ import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
 
 // src/shared/constants.ts
 var PACKAGE_NAME = "@chance722/dsh-inbox";
-var VERSION = true ? "0.2.6" : "0.0.0-dev";
+var VERSION = true ? "0.2.7" : "0.0.0-dev";
 var DEFAULT_USER_AGENT = "dsh-inbox";
 
 // src/shared/vocabulary.ts
@@ -1489,18 +1489,32 @@ function wins(remote, local) {
   if (Number.isNaN(incoming) || Number.isNaN(current)) return false;
   return incoming > current;
 }
+function newerThanPurge(vault, remote) {
+  const purged = vault.purgedAt(remote.id);
+  if (purged === void 0) return true;
+  return Date.parse(remote.updatedAt) > Date.parse(purged);
+}
 async function mergeOnce(vault, tree, prefix, admit) {
   const failures = [];
   let merged = 0;
   let added = 0;
   let deletions = 0;
+  let purged = 0;
   let kept = 0;
   let attachments = 0;
   let objects;
   try {
     objects = await tree.list(`${prefix}/items/`);
   } catch (error) {
-    return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [`\u5217\u8FDC\u7AEF\u540C\u6B65\u76EE\u5F55\u5931\u8D25\uFF1A${reasonOf(error)}`] };
+    return {
+      merged: 0,
+      added: 0,
+      deletions: 0,
+      purged: 0,
+      kept: 0,
+      attachments: 0,
+      failures: [`\u5217\u8FDC\u7AEF\u540C\u6B65\u76EE\u5F55\u5931\u8D25\uFF1A${reasonOf(error)}`]
+    };
   }
   const wanted = /* @__PURE__ */ new Map();
   const bytesAt = /* @__PURE__ */ new Map();
@@ -1524,6 +1538,10 @@ async function mergeOnce(vault, tree, prefix, admit) {
         continue;
       }
       const local = vault.get(remote.id);
+      if (local === void 0 && !newerThanPurge(vault, remote)) {
+        purged += 1;
+        continue;
+      }
       if (!wins(remote, local)) {
         kept += 1;
         continue;
@@ -1566,7 +1584,7 @@ async function mergeOnce(vault, tree, prefix, admit) {
       failures.push(`\u9644\u4EF6 ${attachmentId}\uFF1A${reasonOf(error)}`);
     }
   }
-  return { merged, added, deletions, kept, attachments, failures };
+  return { merged, added, deletions, purged, kept, attachments, failures };
 }
 function extensionOfName(path) {
   return /\.([A-Za-z0-9]{1,8})$/.exec(nameOf2(path))?.[1]?.toLowerCase() ?? "bin";
@@ -1579,7 +1597,9 @@ async function mergeRemote(ctx, vault, attachments, extraRoots = []) {
   const prefix = syncRoot(settings);
   try {
     const tree = settings.protocol === "s3" ? await s3Tree(ctx, settings) : await webdavTree(ctx, settings);
-    if (tree === void 0) return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [] };
+    if (tree === void 0) {
+      return { merged: 0, added: 0, deletions: 0, purged: 0, kept: 0, attachments: 0, failures: [] };
+    }
     const admit = admitWith(attachments);
     const outcome = await mergeOnce(vault, tree, prefix, admit);
     for (const root of extraRoots) {
@@ -1588,13 +1608,22 @@ async function mergeRemote(ctx, vault, attachments, extraRoots = []) {
       outcome.merged += extra.merged;
       outcome.added += extra.added;
       outcome.deletions += extra.deletions;
+      outcome.purged += extra.purged;
       outcome.kept += extra.kept;
       outcome.attachments += extra.attachments;
       outcome.failures.push(...extra.failures);
     }
     return outcome;
   } catch (error) {
-    return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [reasonOf(error)] };
+    return {
+      merged: 0,
+      added: 0,
+      deletions: 0,
+      purged: 0,
+      kept: 0,
+      attachments: 0,
+      failures: [reasonOf(error)]
+    };
   }
 }
 function admitWith(store) {
@@ -1702,6 +1731,7 @@ async function withMerge(ctx, vault, attachments, pulled) {
     merged: outcome.merged,
     added: outcome.added,
     deletions: outcome.deletions,
+    ...outcome.purged === 0 ? {} : { purged: outcome.purged },
     kept: outcome.kept,
     attachments: outcome.attachments,
     failed: pulled.failed + outcome.failures.length,
@@ -2466,6 +2496,12 @@ var attachmentSchema = z3.object({
   /** Present when the medium identifies the bytes by digest. */
   sha256: z3.string().optional()
 });
+var graveSchema = z3.object({
+  /** The record's own key, repeated inside the document (see `attachments`). */
+  id: z3.string().min(1),
+  /** When the user emptied it out of the bin. */
+  purgedAt: timestamp
+});
 var vaultGlobalSchema = z3.object({
   sync: z3.object({
     lastPullAt: z3.string().optional(),
@@ -2518,9 +2554,17 @@ var vaultSpec = defineDomain({
    * Version 7 adds `sync.lastPushAt`: the cursor that keeps a push to "what
    * changed since last time" instead of re-uploading the vault on every pass.
    * A `global` field, so no record shape changes at all.
+   *
+   * Version 8 adds the `graves` table: one row per record the user emptied out
+   * of the bin. A purge leaves no local row, so the merge had nothing to
+   * outrank the cloud's copy with — with 「同时合并别的同步目录」 on, the older
+   * tree in the same bucket filed all thirteen of them back into the bin on
+   * every restart (measured 2026-09-21). A new table, so no record shape
+   * changes; an older vault simply has no graves, and there is nothing to
+   * protect until the next purge.
    */
-  version: 7,
-  compatibleVersions: [1, 2, 3, 4, 5, 6],
+  version: 8,
+  compatibleVersions: [1, 2, 3, 4, 5, 6, 7],
   layout: "per-record",
   global: {
     schema: vaultGlobalSchema,
@@ -2528,7 +2572,8 @@ var vaultSpec = defineDomain({
   },
   tables: {
     items: domainTable(itemSchema),
-    attachments: domainTable(attachmentSchema)
+    attachments: domainTable(attachmentSchema),
+    graves: domainTable(graveSchema)
   }
 });
 
@@ -2599,6 +2644,9 @@ var Vault = class _Vault {
   get attachments() {
     return this.domain.table("attachments");
   }
+  get graves() {
+    return this.domain.table("graves");
+  }
   /** Where the key state stands; what the panel shows and the tools consult. */
   get lockState() {
     return { configured: this.global.master !== void 0, unlocked: this.key !== void 0 };
@@ -2853,16 +2901,26 @@ var Vault = class _Vault {
     });
   }
   /**
-   * Delete one record for good, together with its attachment rows.
+   * Delete one record for good, together with its attachment rows, and leave a
+   * grave behind so nothing that is still in the cloud can file it again.
    *
    * The bytes behind an attachment live in dsh's own store, which never deletes
    * automatically — emptying the recycle bin drops our references, not their
    * objects. A row another record still references is left alone.
    *
+   * The grave is the other half of that sentence, and it is why this is not
+   * called `remove` any more: deleting the row really does take this machine's
+   * copy away, but a copy under a *different* `sync/` tree in the same bucket
+   * survives the purge of our own tree (`../remote/remove.ts` only ever deletes
+   * under this vault's root), and the merge has no local row to outrank it with.
+   * Measured 2026-09-21: thirteen emptied tombstones came back into the bin on
+   * every `dsh` restart. The grave is what makes "gone" stick; it holds the id
+   * and the moment, no content.
+   *
    * @param id - record key.
    * @returns whether the record existed.
    */
-  async remove(id) {
+  async purge(id) {
     const item = this.items.get(id);
     if (item === void 0) return false;
     const stillReferenced = /* @__PURE__ */ new Set();
@@ -2873,7 +2931,18 @@ var Vault = class _Vault {
     for (const attachmentId of item.attachmentIds) {
       if (!stillReferenced.has(attachmentId)) await this.attachments.delete(attachmentId);
     }
-    return this.items.delete(id);
+    await this.items.delete(id);
+    await this.graves.put(id, { id, purgedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return true;
+  }
+  /**
+   * When this id was emptied out of the bin, if it ever was.
+   *
+   * The merge asks this before taking a copy of a record this vault does not
+   * have (see `newerThanPurge` in `../remote/merge.ts`).
+   */
+  purgedAt(id) {
+    return this.graves.get(id)?.purgedAt;
   }
   /**
    * Record an attachment's metadata. The bytes stay in the store named by
@@ -3253,7 +3322,7 @@ async function handlePurge(ctx, vault) {
   }
   let removed = 0;
   for (const item of bin) {
-    if (await vault.remove(item.id)) removed += 1;
+    if (await vault.purge(item.id)) removed += 1;
   }
   const stillReferenced = new Set(
     vault.list({ includeDeleted: true }).flatMap((item) => [...item.attachmentIds])

package/lib/types/client/messages.d.ts

@@ -181,6 +181,7 @@ export declare const zh: {
     'sync.detailPulled': string;
     'sync.detailAdded': string;
     'sync.detailDeleted': string;
+    'sync.detailPurged': string;
     'sync.pullForeignSync': string;
     'sync.detailForeign': string;
     'sync.shortPushed': string;
@@ -444,6 +445,7 @@ export declare const MESSAGES: {
         'sync.detailPulled': string;
         'sync.detailAdded': string;
         'sync.detailDeleted': string;
+        'sync.detailPurged': string;
         'sync.pullForeignSync': string;
         'sync.detailForeign': string;
         'sync.shortPushed': string;

package/lib/types/host/remote/merge.d.ts

@@ -59,6 +59,16 @@ export interface MergeOutcome {
      * 2026-09-21, after merging an abandoned tree whose copies mostly overlapped).
      */
     added: number;
+    /**
+     * Copies of records this vault **emptied out of the bin** — left alone, on
+     * purpose, because a purge is not a deletion to be argued with.
+     *
+     * Counted apart from {@link kept}: "the cloud has a copy you already have" and
+     * "the cloud has a copy of something you threw away" are different sentences,
+     * and only the second one answers "so why did the emptied records stay empty
+     * this time?" (2026-09-21).
+     */
+    purged: number;
     /** Records the remote had and this machine already had, newer or equal. */
     kept: number;
     /** Attachment objects pulled down (bytes plus their row). */

package/lib/types/host/vault/spec.d.ts

@@ -67,6 +67,31 @@ export declare const attachmentSchema: z.ZodObject<{
     height: z.ZodOptional<z.ZodNumber>;
     sha256: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * One grave: the id the user emptied out of the recycle bin, and when.
+ *
+ * Emptying the bin is not "deleted" — it is *gone*, and a copy of the record
+ * living somewhere else (another `sync/` tree in the same bucket, a device that
+ * has not pulled the tombstone yet) must not be able to file it back in.
+ * `updatedAt` cannot express that on its own: the merge compares the incoming
+ * copy against the local one, and after a purge there is no local row at all,
+ * so any copy won. That is measured, not theoretical — thirteen tombstones came
+ * back into the bin on every restart (2026-09-21).
+ *
+ * It carries an id and a time and nothing else: no text, no note, no
+ * attachment. What the row buys is the one comparison the merge needs — a copy
+ * **at or before** this moment is dead, a copy strictly newer still wins, the
+ * same way it does for a record that was never deleted.
+ *
+ * Nothing ever collects these, and that is deliberate rather than an oversight:
+ * a grave that has been pruned is a hole reopened — the copy it was holding out
+ * is exactly as old as it was, and the next pull takes it. One row per emptied
+ * record, six fields of JSON, for as long as the vault lives.
+ */
+export declare const graveSchema: z.ZodObject<{
+    id: z.ZodString;
+    purgedAt: z.ZodString;
+}, z.core.$strip>;
 /**
  * One global slot per domain. Sync state lives here because it belongs to the
  * vault as a whole, not to any item; M6 fills it in.
@@ -96,6 +121,7 @@ export declare const vaultGlobalSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type Item = z.infer<typeof itemSchema>;
 export type Attachment = z.infer<typeof attachmentSchema>;
+export type Grave = z.infer<typeof graveSchema>;
 export type VaultGlobal = z.infer<typeof vaultGlobalSchema>;
 /**
  * Domain name doubles as the backend unit name: `<DSH_HOME>/storages/dsh_inbox/…`.
@@ -122,6 +148,14 @@ export declare const vaultSpec: {
      * Version 7 adds `sync.lastPushAt`: the cursor that keeps a push to "what
      * changed since last time" instead of re-uploading the vault on every pass.
      * A `global` field, so no record shape changes at all.
+     *
+     * Version 8 adds the `graves` table: one row per record the user emptied out
+     * of the bin. A purge leaves no local row, so the merge had nothing to
+     * outrank the cloud's copy with — with 「同时合并别的同步目录」 on, the older
+     * tree in the same bucket filed all thirteen of them back into the bin on
+     * every restart (measured 2026-09-21). A new table, so no record shape
+     * changes; an older vault simply has no graves, and there is nothing to
+     * protect until the next purge.
      */
     version: number;
     compatibleVersions: number[];
@@ -188,6 +222,10 @@ export declare const vaultSpec: {
             height?: number | undefined;
             sha256?: string | undefined;
         }>;
+        graves: import("@deepseek-ai/dsh-storage-domain").DomainTableSpec<string, {
+            id: string;
+            purgedAt: string;
+        }>;
     };
 };
 export type VaultSpec = typeof vaultSpec;

package/lib/types/host/vault/vault.d.ts

@@ -96,6 +96,7 @@ export declare class Vault {
     private migrateOnce;
     private get items();
     private get attachments();
+    private get graves();
     /** Where the key state stands; what the panel shows and the tools consult. */
     get lockState(): VaultLockState;
     /**
@@ -211,16 +212,33 @@ export declare class Vault {
     /** Undo a soft delete. */
     restore(id: string): Promise<Item>;
     /**
-     * Delete one record for good, together with its attachment rows.
+     * Delete one record for good, together with its attachment rows, and leave a
+     * grave behind so nothing that is still in the cloud can file it again.
      *
      * The bytes behind an attachment live in dsh's own store, which never deletes
      * automatically — emptying the recycle bin drops our references, not their
      * objects. A row another record still references is left alone.
      *
+     * The grave is the other half of that sentence, and it is why this is not
+     * called `remove` any more: deleting the row really does take this machine's
+     * copy away, but a copy under a *different* `sync/` tree in the same bucket
+     * survives the purge of our own tree (`../remote/remove.ts` only ever deletes
+     * under this vault's root), and the merge has no local row to outrank it with.
+     * Measured 2026-09-21: thirteen emptied tombstones came back into the bin on
+     * every `dsh` restart. The grave is what makes "gone" stick; it holds the id
+     * and the moment, no content.
+     *
      * @param id - record key.
      * @returns whether the record existed.
      */
-    remove(id: string): Promise<boolean>;
+    purge(id: string): Promise<boolean>;
+    /**
+     * When this id was emptied out of the bin, if it ever was.
+     *
+     * The merge asks this before taking a copy of a record this vault does not
+     * have (see `newerThanPurge` in `../remote/merge.ts`).
+     */
+    purgedAt(id: string): string | undefined;
     /**
      * Record an attachment's metadata. The bytes stay in the store named by
      * `storeId`; this row is our own index over them, keyed by a generated id

package/lib/types/shared/panel-wire.d.ts

@@ -92,8 +92,10 @@ export interface WebdavSettings {
      * cloud drive": a machine that used to sync somewhere else leaves its records
      * behind, and they come back (asked 2026-09-21, 19 records). Merging settles
      * per record by `id` + `updatedAt`, so an older tree cannot overwrite a newer
-     * copy — but it *can* bring back a record that was purged here, because a
-     * purge leaves nothing local to outrank it.
+     * copy — and a record the user **emptied out of the bin** stays gone: the
+     * grave that `purge` leaves is the thing such a copy cannot outrank (it used
+     * to, and thirteen emptied tombstones came back into the bin on every restart
+     * — measured 2026-09-21).
      */
     adoptForeignRoots: boolean;
     username: string;
@@ -175,6 +177,15 @@ export interface PullResult {
     merged?: number;
     /** How many of {@link merged} were ids this vault did not have at all. */
     added?: number;
+    /**
+     * Copies the cloud still holds of records this vault **emptied out of the bin**.
+     *
+     * Not taken in, on purpose: `purge` leaves a grave, and a copy that is not
+     * *newer* than it does not come back (see `graves` in `src/host/vault/spec.ts`).
+     * Reported because a reader who just emptied the bin is owed the sight of the
+     * older tree trying and being refused.
+     */
+    purged?: number;
     /** How many of {@link merged} were deletions (they land in the recycle bin). */
     deletions?: number;
     /** Attachment objects the merge had to fetch and admit locally. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chance722/dsh-inbox",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "private": false,
   "description": "Personal paste inbox for DeepSeek Harness (dsh): capture, classify, browse and retrieve.",
   "keywords": [