dsh-archived-chats 1.0.2 → 1.0.4

package/README.md

@@ -76,7 +76,7 @@ Features activate from the public capabilities exposed by the DeepSeek Harness H
 | --- | --- |
 | Archive and session reads | Browsing, search, preview, History inventory, storage accounting, and lineage. |
 | Attachment reads | Stored images appear in conversation and snapshot previews; without it, text remains readable. |
-| Public persistence writer | Required for ZIP import, **Restore as copy**, and snapshot fallback when an original is missing. |
+| Public session writer | ZIP import, **Restore as copy**, and snapshot fallback when an original is missing all write through the Host's public `create` / `append` / `locate` capability, or a dedicated restore entry point where one exists. |
 | Missing write capability | The operation returns `restore-unsupported` without writing or overwriting data. |
 
 Back up `$DSH_HOME/plugin-data/archived-chats/` before downgrading to a release that does not display History or understand recycle snapshots.

package/README.zh-CN.md

@@ -76,7 +76,7 @@ dsh plugin --profile web update dsh-archived-chats
 | --- | --- |
 | 归档与会话读取 | 浏览、搜索、预览、历史清单、空间分账和会话血缘。 |
 | 附件读取 | 对话和快照预览可显示已存储图片；缺少时文本内容仍可阅读。 |
-| 公开持久层 writer | ZIP 导入、**恢复为副本**，以及原件丢失时的快照回退恢复需要此能力。 |
+| 公开会话 writer | ZIP 导入、**恢复为副本** 和原件丢失时的快照回退，都通过 Host 公开的 `create` / `append` / `locate` 能力写入；Host 提供专用恢复入口时优先使用。 |
 | 缺少写入能力 | 操作返回 `restore-unsupported`，不会写入或覆盖数据。 |
 
 降级到不显示历史版本或不识别回收快照的版本前，请备份 `$DSH_HOME/plugin-data/archived-chats/`。

package/docs/ARCHITECTURE.en.md

@@ -76,7 +76,7 @@ Preview accepts visible archived IDs by default and only recycle-catalog IDs wit
 
 The preview/image authorization sequence is fixed: first require POST and `x-dsh-archived-chats: 1`, then bounded-parse `sessionId` and `attachmentId`; next confirm that the session is still in the currently visible archive set, find an exact image-descriptor match in that session's canonical projection, and only then read bytes through the optional `attachments.readImage` service. Both preview and preview/image recheck visible archive state after asynchronous reads and immediately before sending a response, preventing an overlapping unarchive or delete from exposing stale content. Image bytes use `no-store` and `nosniff`; cross-session, non-archived, and unprojected references are rejected, and error responses never echo filesystem paths. A host without attachment-read capability returns `preview-image-unsupported`; this degrades images only and does not block text, Markdown, reasoning, tool, JSON, or code preview.
 
-Cross-session persistence inspection is limited to four concurrent reads. A broken session is reported in `skipped` while other hits still succeed. Canonical projections use a 30-second TTL, a 64-session LRU, and a per-session cached-code-point cap; oversized sessions remain searchable but do not stay resident. Unarchive, delete, and restore invalidate affected cache entries.
+Cross-session persistence inspection is limited to four concurrent reads, stops scheduling batches once the hit limit is satisfied, and aborts an older browser request when a newer search starts. A broken session is reported in `skipped` while other hits still succeed. Canonical projection limits each segment to 256 Ki code points, each message to 1 Mi code points and 1,000 segments, and each session to 10,000 projected messages; unknown structured values are bounded by depth, node, and character budgets before stringify. A 30-second TTL, 64-session LRU, and per-session cache cap keep bounded projections resident. Unarchive, delete, and restore invalidate affected cache entries.
 
 ## History versions and restore-as-copy
 
@@ -86,7 +86,7 @@ Cross-session persistence inspection is limited to four concurrent reads. A brok
 
 `history-restore.js` fully validates the snapshot, asks the Host for a new session ID, and issues a five-minute single-use token/nonce. Confirmation consumes the credential before writes and rechecks the manifest, then creates persistence, rewrites session/attachment identities, appends events, restores workspace and metadata, and commits archive registry state last. Failures reverse plugin-controlled steps. The source session and snapshot never change, and the plugin makes no claim that Host-global attachment objects were deleted.
 
-Single-version deletion and **Clear history versions** both enter the shared lifecycle queue and bypass the ordinary 30-second cache/in-flight list so current snapshot and recycle-protection state is recomputed. Single deletion rejects `recycle-protection`; clear removes only healthy ordinary history and skips recycle-protection and degraded snapshots. Deletion physically removes the plugin snapshot and its attachment copies, so that version can no longer be previewed or restored, while the original chat and other versions remain unchanged.
+Single-version deletion and **Clear history versions** both enter the shared lifecycle queue and bypass the ordinary 30-second cache/in-flight list so current snapshot and recycle-protection state is recomputed. Both reject a snapshot a recycle record still names, degraded or not — that record is its last claim. Both otherwise accept a degraded snapshot: it can no longer be previewed or restored from, but its bytes are still on disk and no other surface can reclaim them (retention plans only healthy snapshots), so refusing here would leak the store permanently. Deletion physically removes the plugin snapshot and its attachment copies, while the original chat and other versions remain unchanged.
 
 ## Export flow
 
@@ -104,7 +104,7 @@ ZIP paths are sanitized and collision-safe. Batch export inspects and writes ses
 
 ## Import and restore flow
 
-import/inspect accepts only version-one ZIPs produced by this plugin. The Host streams bounded compressed chunks, preflights declared entry sizes, counts actual output, and caps entry count, per-entry bytes, manifest bytes, and total expansion. Iterative JSON validation then caps depth, node count, and total Unicode code points before path, version, session-record, and cross-file checks return a preview:
+import/inspect accepts only version-one ZIPs produced by this plugin. The Host streams bounded compressed chunks, preflights declared entry sizes, counts actual output, and caps entry count, per-entry bytes, manifest bytes, and total expansion. Iterative JSON validation then caps depth, node count, and total Unicode code points before checking paths, versions, generator, workspace, storage descriptors, timestamps, `source.meta.id`, the event array, and cross-file consistency:
 
 1. The browser uploads the ZIP and receives session summaries, versions, size, and warnings.
 2. Existing session IDs are marked as conflicts and deselected by default.
@@ -113,19 +113,19 @@ import/inspect accepts only version-one ZIPs produced by this plugin. The Host s
 5. restore.js uses a feature-detected adapter to write sessions, metadata, and archive state.
 6. Any failure rolls back staged data and never overwrites an existing session.
 
-The confirmation token expires quickly and can be used once. Hosts without the supported writer capability return restore-unsupported without writing.
+The confirmation token expires quickly, can be used once, and is bounded to eight retained plans and 128 MiB total per process. Confirmation-time conflict revalidation, staging, and commit all run inside the shared lifecycle queue. Import resolves a session writer by capability: a dedicated Host restore entry point when one exists, otherwise the ordinary `create` / `append` / `locate` surface — the same capability History restore-as-copy writes through, so import works wherever that works. The append writer carries its own session-scoped rollback (it confirms the located directory is the session's own before creating anything), so a separate removal capability is required only for a dedicated restore entry point. Archive and metadata write capabilities are still required. The staged id does not exist yet, so a session reader that fails closed on unknown ids is the expected answer to the capability probe and never aborts the restore. Workspace attach is used only with a matching detach, otherwise the item restores ungrouped with a warning. A boundary that throws after changing state is compensated in reverse order; failed compensation is reported explicitly rather than returning false success.
 
 ## Recycle and protection-snapshot lifecycle
 
 `trash.json` permits only `trashed`, `purge-pending`, and `degraded`. Legal transitions are `missing -> trashed`, `trashed/degraded -> purge-pending`, and removal of an existing state after a committed transaction. A `purge-pending` record cannot restore.
 
-Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits remain 4 MiB manifest, 512 MiB session JSON, 10,000 attachments, 32 MiB each, and 8 GiB total.
+Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits are 4 MiB manifest, 64 MiB session JSON, 1,000 attachments, 32 MiB each, and 512 MiB total. Restore validation streams attachment digests first and rereads one attachment at a time immediately before Host writes, never retaining all attachment bytes together. Snapshot publication/deletion and state-file renames sync file and parent-directory durability, with a safe fallback on Windows filesystems that do not expose directory fsync. Windows cannot atomically replace a file or remove a directory entry while another handle is open on it — an indexer or antivirus scan is enough — so replaces and recursive removals retry the transient `EPERM` / `EACCES` / `EBUSY` codes there, bounded, and only there: on POSIX the same codes are permanent conditions and retrying would only delay the same failure. Snapshot publication also treats a rename refused onto an existing directory as a conflict after probing the destination, because Windows reports that as `EPERM` rather than `EEXIST`. Path containment is tested with the platform separator and rejects an absolute answer, so a Windows `..\` escape or a different drive letter cannot read as inside the root.
 
 Move ordering is: validate archive ownership → dispose or park a live session → capture and verify snapshot → recheck ownership → atomically commit `trashed` → invalidate caches. Ordinary move never removes the persistence artifact.
 
 Restore first rejects an existing-ID conflict. With an intact original it restores archive visibility and removes only the recycle record, without rewriting persistence; the snapshot remains history. With a missing original it completes validation and attachment-identity republishing before writing through public `create` / `append` / `saveImage` capabilities. A failure rolls back the new artifact and retains trash.
 
-Permanent purge persists `purge-pending` before physical writes, then removes the original, every validated snapshot for that source, and the recycle record. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
+Permanent purge persists `purge-pending` before physical writes, then removes every snapshot for that source, then the original session, and finally the recycle record. The session delete is deliberately last: a failure before it leaves the original intact and the record completable, rather than a `purge-pending` record whose session is already gone and which can therefore neither restore nor complete. The snapshot sweep attributes each published snapshot by manifest identity so a snapshot that fails validation is still removed when it belongs to this session, and an unrelated unverifiable snapshot is skipped instead of aborting the sweep — corruption elsewhere in the store must never make a purge impossible. The recycle record also names its own snapshot id, covering one damaged past attribution. Workspace, metadata, snapshot, or physical-delete failures retain `purge-pending`; snapshot deletion is rescanned before success can be returned. Physical deletion additionally requires the located artifact to sit in a directory named for the session itself, so a backend layout that shares one parent between sessions can never have that parent removed. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
 
 ## Browser client
 
@@ -158,7 +158,7 @@ The browser never mutates files directly. After an operation, the Host response
 
 ## Compatibility and testing
 
-The plugin adapts through Host capability detection: archive reads, attachment reads, persistence writes, and live-session lifecycle support are evaluated independently, and missing capabilities must degrade safely or return explicit errors. Import, History restore-as-copy, and snapshot fallback when the original is missing require a public writer; without it they return `restore-unsupported` without mutation. Back up the complete plugin-data directory before downgrading to a release that does not display History or understand recycle snapshots.
+The plugin adapts through Host capability detection: archive reads, attachment reads, persistence writes, and live-session lifecycle support are evaluated independently, and missing capabilities must degrade safely or return explicit errors. Import, History restore-as-copy, and snapshot fallback when the original is missing all write through the public `create` / `append` / `locate` capability, or a dedicated restore entry point where the Host offers one; only a Host exposing neither returns `restore-unsupported` without mutation. A capability set that no shipped Host satisfies is not an acceptable guard — it makes the feature permanently dead rather than gracefully degraded. Back up the complete plugin-data directory before downgrading to a release that does not display History or understand recycle snapshots.
 
 Coverage includes:
 

package/docs/ARCHITECTURE.md

@@ -76,7 +76,7 @@ preview 默认只接受当前可见归档 ID；显式 `scope: "trash"` 时仅接
 
 preview/image 的授权顺序固定为：先验证 POST 和 `x-dsh-archived-chats: 1`，再有界解析 `sessionId` 与 `attachmentId`；随后确认会话仍在当前可见归档集合中，从该会话的规范投影中查找完全匹配的图片描述符，最后才通过可选的 `attachments.readImage` 服务读取。preview 和 preview/image 都会在异步读取完成后、响应发送前再次检查可见归档状态，避免并发取消归档或删除泄露旧内容。图片字节以 `no-store`、`nosniff` 返回；跨会话、非归档或不在投影中的引用均会被拒绝，错误响应不回显文件路径。宿主没有附件读取能力时返回 `preview-image-unsupported`；这只降级图片，不阻塞文本、Markdown、思考、工具、JSON 或代码预览。
 
-跨会话搜索的持久层读取并发上限为 4；单个会话失败会记入 skipped，其他命中仍正常返回。规范投影使用 30 秒 TTL、64 会话 LRU 和单会话最大缓存字符数保护内存；超大会话仍可搜索，但不会常驻缓存。取消归档、删除和恢复会使相关缓存失效。
+跨会话搜索的持久层读取并发上限为 4，达到命中上限后不再调度后续批次，浏览器的新搜索会中止旧请求；单个会话失败会记入 skipped，其他命中仍正常返回。规范投影使用 30 秒 TTL、64 会话 LRU，并限制单段 256 Ki Unicode 码点、单消息 1 Mi 码点/1,000 段、单会话 10,000 条投影消息；结构化未知值在 stringify 前即受深度、节点和字符预算约束。超出投影边界的内容会安全截断且不会常驻缓存。取消归档、删除和恢复会使相关缓存失效。
 
 ## 历史版本与恢复为副本
 
@@ -86,7 +86,7 @@ preview/image 的授权顺序固定为：先验证 POST 和 `x-dsh-archived-chat
 
 `history-restore.js` 先完整验证快照，用 Host 生成新会话 ID，再签发五分钟、单次使用的 token/nonce。确认时先消费凭据并重验 manifest；然后依次创建持久会话、重写会话/附件身份、附加事件、恢复工作区和元数据，最后才写入归档注册表。任一插件控制的边界失败都按逆序回滚；来源会话与快照始终不变，也不声称删除了 Host 全局附件对象。
 
-历史页的单条删除与「清空历史版本」都进入共用生命周期队列，并绕过普通 30 秒缓存/进行中请求，重新计算当前快照与回收保护关系。单条删除拒绝 `recycle-protection`；清空只删除健康普通历史，跳过回收保护和降级快照。删除会物理移除插件快照及其附件副本，无法再预览或恢复，但不修改原聊天或其他版本。
+历史页的单条删除与「清空历史版本」都进入共用生命周期队列，并绕过普通 30 秒缓存/进行中请求，重新计算当前快照与回收保护关系。两者都拒绝仍被回收记录引用的快照（无论是否降级）——那条记录是它最后的归属。除此之外两者都接受降级快照：它已无法预览或恢复，但字节仍在磁盘上，而其他任何入口都无法回收它们（保留策略只规划健康快照），在这里拒绝就意味着永久泄漏。删除会物理移除插件快照及其附件副本，但不修改原聊天或其他版本。
 
 ## 导出流程
 
@@ -104,7 +104,7 @@ ZIP 路径会清理遍历字符并处理重名。批量导出按会话顺序逐
 
 ## 导入和恢复流程
 
-import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩块流式解压，先核对条目声明大小，再累计实际输出，并限制条目数、单条目、manifest 与总解压量。JSON 校验使用迭代遍历限制深度、节点数和 Unicode 字符总量，然后继续校验路径、版本、会话记录及跨文件一致性并生成预览：
+import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩块流式解压，先核对条目声明大小，再累计实际输出，并限制条目数、单条目、manifest 与总解压量。JSON 校验使用迭代遍历限制深度、节点数和 Unicode 字符总量，然后继续校验路径、版本、生成器、工作区、存储描述符、时间戳、`source.meta.id`、事件数组及跨文件一致性并生成预览：
 
 1. 浏览器上传 ZIP，Host 返回会话摘要、版本、大小和警告。
 2. 已存在的会话 ID 标记为冲突并默认取消选择。
@@ -113,19 +113,19 @@ import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩
 5. restore.js 通过能力探测的适配器写入会话、元数据和归档状态。
 6. 任一步骤失败都回滚暂存数据，不覆盖已有会话。
 
-确认令牌短期有效且只能使用一次。宿主不支持写入能力时返回 restore-unsupported，不执行任何写入。
+确认令牌短期有效且只能使用一次，并受 8 条、总计 128 MiB 的进程内保留上限约束。确认后的冲突重检、暂存和提交全部进入共享生命周期队列。导入按能力解析会话 writer：有专用恢复入口时优先使用，否则使用普通的 `create` / `append` / `locate` 面——也就是历史版本恢复为副本写入所用的同一能力，因此后者能工作的地方导入就能工作。append writer 自带会话作用域回滚（创建任何东西之前先确认定位到的目录属于该会话本身），所以只有专用恢复入口才需要额外的删除能力；归档与元数据写入能力仍然必需。待恢复 id 尚不存在，因此对未知会话 fail-closed 的读取器正是能力探测的预期回答，不会中断恢复。工作区 attach 必须有对应 detach，否则按未分组警告处理。任一边界即使在抛错前已经改变状态，也会按逆序补偿；无法完成补偿时明确返回 rollback failed，而不会报告恢复成功。
 
 ## 回收与保护快照生命周期
 
 `trash.json` 的合法状态只有 `trashed`、`purge-pending`、`degraded`。合法转换为 `missing -> trashed`、`trashed/degraded -> purge-pending`，以及任一现有状态在事务成功后移除。`purge-pending` 不得恢复。
 
-保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 512 MiB、10,000 个附件、单附件 32 MiB、总计 8 GiB。
+保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 64 MiB、1,000 个附件、单附件 32 MiB、总计 512 MiB；恢复验证先流式校验附件摘要，再在写入 Host 前逐件复读，绝不同时保留全部附件字节。发布、删除与状态文件的 rename 会同步文件和父目录；不支持目录 fsync 的 Windows 文件系统安全降级。Windows 在目标仍被其他句柄打开时无法原子替换文件或移除目录项（索引服务或杀毒扫描即可导致），因此替换与递归删除会在该平台上、且仅在该平台上，对瞬时的 `EPERM` / `EACCES` / `EBUSY` 做有界重试：POSIX 上这些码表示永久条件，重试只会延后同一个失败。快照发布还会在 rename 被拒时探测目标目录再判定为冲突，因为 Windows 把「rename 到已存在目录」报成 `EPERM` 而不是 `EEXIST`。路径包含判定使用平台分隔符并拒绝绝对结果，因此 Windows 的 `..\` 逃逸或不同盘符都不会被误判为在根目录内。
 
 移入顺序为：校验归档所有权 → 处置/停放运行中会话 → 捕获并验证快照 → 再次校验所有权 → 原子写入 `trashed` 记录 → 使缓存失效。普通移入不删除持久层文件。
 
 恢复先检查同 ID 冲突。原会话完好时只恢复归档可见性并移除回收记录，不重写持久层，保护快照保留为历史；原件丢失时先完成所有校验和附件身份重发，然后仅通过公开 `create` / `append` / `saveImage` 能力写入。失败会回滚新建件并保留回收记录。
 
-永久删除在任何物理写入前持久化 `purge-pending`，再删除原会话、该来源的全部已验证快照和回收记录。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
+永久删除在任何物理写入前持久化 `purge-pending`，接着删除该来源的全部快照，然后删除原会话，最后移除回收记录。会话删除刻意放在最后：在它之前失败会保留完好的原件和可继续完成的记录，而不是留下一条会话已消失、既不能恢复也不能完成的 `purge-pending`。快照清扫按 manifest 身份归属每个已发布快照，因此校验失败但确属该会话的快照仍会被删除，而无关的无法校验快照会被跳过而不是中断整个清扫——快照库别处的损坏绝不能让永久删除变成不可能。回收记录还会点名自己的快照 id，覆盖损坏到无法归属的那一个。工作区、元数据、快照或物理删除任一步骤失败时都保留 `purge-pending`；快照删除后还会重新扫描确认，不会虚假报告成功。物理删除另外要求定位到的文件位于以该会话自身命名的目录中，因此当后端布局让多个会话共享同一父目录时，那个父目录永远不会被删除。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
 
 ## 浏览器客户端
 
@@ -158,7 +158,7 @@ client.js 注册 order 30 的 settings.section，并使用 Harness 公开的浮
 
 ## 兼容性和测试
 
-插件通过能力检测适配 Host：归档读取、附件读取、持久层写入和运行中会话生命周期能力分别判断，缺失能力必须安全降级或返回明确错误。导入、历史版本恢复为副本和原件丢失时的快照回退需要公开 writer；缺少时返回 `restore-unsupported` 且不写入数据。旧版若不显示历史页或不识别回收快照，降级前应备份整个插件数据目录。
+插件通过能力检测适配 Host：归档读取、附件读取、持久层写入和运行中会话生命周期能力分别判断，缺失能力必须安全降级或返回明确错误。导入、历史版本恢复为副本和原件丢失时的快照回退都通过公开的 `create` / `append` / `locate` 能力写入，Host 提供专用恢复入口时优先使用；只有两者都不存在才返回 `restore-unsupported` 且不写入数据。要求一组没有任何已发布 Host 能满足的能力不是合格的守卫——那会让功能永久失效，而不是优雅降级。旧版若不显示历史页或不识别回收快照，降级前应备份整个插件数据目录。
 
 测试覆盖：
 

package/lib/client.js

@@ -261,6 +261,9 @@ window.__ModuleLoader__.load({
 				"history.scope.history-only": "仅历史保留",
 				"history.degraded": "无法读取的历史版本",
 				"history.degradedItem": "无法验证",
+				"history.degradedDelete": "清除",
+				"history.degradedDeleteTitle": "清除这个无法读取的历史版本？",
+				"trash.listUnverified": "回收站目录无法读取：下面的列表可能包含已删除的聊天，归档修改已暂停。",
 				"insights.loading": "正在分析空间…",
 				"insights.error": "空间分析暂不可用",
 				"insights.scopeNote": "这里只统计已归档、回收站会话，以及本插件为它们创建并继续保留的恢复快照。恢复聊天后快照仍可保留，所以归档列表为空时这里仍可能有数据。",
@@ -522,6 +525,9 @@ window.__ModuleLoader__.load({
 				"history.scope.history-only": "History only",
 				"history.degraded": "Unreadable history versions",
 				"history.degradedItem": "Could not verify",
+				"history.degradedDelete": "Reclaim",
+				"history.degradedDeleteTitle": "Reclaim this unreadable history version?",
+				"trash.listUnverified": "The Recycle Bin catalog is unreadable: this list may include deleted chats, and archive changes are paused.",
 				"insights.loading": "Analyzing storage…",
 				"insights.error": "Storage insights are unavailable",
 				"insights.scopeNote": "This page measures archived and recycled chats plus recovery snapshots this plugin created and retained for them. Restoring a chat may retain its snapshot, so storage can remain when the archive list is empty.",
@@ -805,6 +811,11 @@ window.__ModuleLoader__.load({
 				return new Date(ms).toLocaleString();
 			}
 		}
+		function isoTimestamp(ms) {
+			if (typeof ms !== "number" || !Number.isFinite(ms)) return undefined;
+			const date = new Date(ms);
+			return Number.isFinite(date.valueOf()) ? date.toISOString() : undefined;
+		}
 
 		function formatBytes(value) {
 			if (!Number.isFinite(value) || value < 0) return "—";
@@ -1403,6 +1414,10 @@ window.__ModuleLoader__.load({
 			return {
 				sessions: Array.isArray(body.sessions) ? body.sessions : [],
 				metadataStatus: body.metadataStatus === "unavailable" ? "unavailable" : "ready",
+				// An unreadable recycle catalog cannot be subtracted from this list, so
+				// already-deleted chats can reappear here. Surface it instead of
+				// silently showing them as ordinary archived chats.
+				trashStatus: body.trashStatus === "unavailable" ? "unavailable" : "ready",
 			};
 		}
 
@@ -1524,8 +1539,8 @@ window.__ModuleLoader__.load({
 			return res.blob();
 		}
 
-		async function fetchArchiveSearch(query, limit = 50) {
-			return post("/search", { query, limit });
+		async function fetchArchiveSearch(query, limit = 50, signal) {
+			return post("/search", { query, limit }, signal);
 		}
 
 			async function saveMetadata(sessionId, tags, note) {
@@ -2240,7 +2255,7 @@ window.__ModuleLoader__.load({
 						setCopied(true);
 					};
 					return (0, jsx.jsxs)("div", { className: "dac-preview-actions", children: [
-						(0, jsx.jsx)("time", { dateTime: Number.isFinite(node.time) ? new Date(node.time).toISOString() : undefined, children: formatDate(t, node.time) }),
+						(0, jsx.jsx)("time", { dateTime: isoTimestamp(node.time), children: formatDate(t, node.time) }),
 						(0, jsx.jsx)("button", { type: "button", onClick: copy, "aria-label": copied ? t("preview.copied") : t("preview.copy"), children: copied ? t("preview.copied") : t("preview.copy") }),
 					] });
 				}
@@ -3077,6 +3092,14 @@ window.__ModuleLoader__.load({
 				setDeleteDialog({ kind: "one", session, version });
 				setMessage(null);
 			};
+			// Unreadable versions still occupy the snapshot store, so they need their
+			// own reclaim path — they never appear as a restorable version row.
+			const askDeleteDegraded = (item) => {
+				if (deleteBusy || restoreDialog !== null) return;
+				deleteReturnFocusRef.current = document.activeElement;
+				setDeleteDialog({ kind: "degraded", item });
+				setMessage(null);
+			};
 			const askClearHistory = () => {
 				if (clearSummary.versionCount === 0 || deleteBusy || restoreDialog !== null) return;
 				deleteReturnFocusRef.current = document.activeElement;
@@ -3088,9 +3111,9 @@ window.__ModuleLoader__.load({
 				const current = deleteDialog;
 				setDeleteBusy(true);
 				try {
-					const result = current.kind === "one"
-						? await deleteHistoryVersion(current.version.snapshotId)
-						: await clearHistoryVersions();
+					const result = current.kind === "all"
+						? await clearHistoryVersions()
+						: await deleteHistoryVersion(current.kind === "degraded" ? current.item.snapshotId : current.version.snapshotId);
 					setDeleteDialog(null);
 					await load();
 					const deletedCount = Array.isArray(result?.deleted) ? result.deleted.length : 0;
@@ -3111,7 +3134,11 @@ window.__ModuleLoader__.load({
 					setDeleteBusy(false);
 				}
 			};
-			const deleteBody = deleteDialog === null ? "" : deleteDialog.kind === "one"
+			const deleteBody = deleteDialog === null ? "" : deleteDialog.kind === "degraded"
+				? (isZh(t)
+					? `该历史版本已无法读取或校验，不能再用于恢复。清除后将释放它占用的磁盘空间；原聊天不会被删除。`
+					: `This history version can no longer be read or verified, so it cannot be restored from. Reclaiming it frees the disk space it still occupies. The original chat is not deleted.`)
+				: deleteDialog.kind === "one"
 				? (() => {
 					const title = deleteDialog.session.title || t("chat.untitled");
 					const createdMs = Date.parse(deleteDialog.version.createdAt);
@@ -3205,6 +3232,13 @@ window.__ModuleLoader__.load({
 					...state.degraded.map((item) => (0, jsx.jsxs)("div", { className: "dac-history-degraded-row", children: [
 						(0, jsx.jsx)("code", { children: item.snapshotId }),
 						(0, jsx.jsx)("span", { children: t("history.degradedItem") }),
+						(0, jsx.jsx)("button", {
+							type: "button",
+							className: "dac-btn dac-history-delete",
+							disabled: deleteBusy || deleteDialog !== null || restoreDialog !== null,
+							onClick: () => askDeleteDegraded(item),
+							children: t("history.degradedDelete"),
+						}),
 					] }, item.snapshotId)),
 				] }),
 				restoreDialog !== null && (0, jsx.jsx)(ConfirmDialog, {
@@ -3220,9 +3254,9 @@ window.__ModuleLoader__.load({
 					onCancel: () => setRestoreDialog(null),
 				}),
 				deleteDialog !== null && (0, jsx.jsx)(ConfirmDialog, {
-					title: t(deleteDialog.kind === "one" ? "history.deleteTitle" : "history.clearTitle"),
+					title: t(deleteDialog.kind === "one" ? "history.deleteTitle" : deleteDialog.kind === "degraded" ? "history.degradedDeleteTitle" : "history.clearTitle"),
 					body: deleteBody,
-					confirmLabel: t(deleteDialog.kind === "one" ? "history.deleteConfirm" : "history.clear"),
+					confirmLabel: t(deleteDialog.kind === "all" ? "history.clear" : "history.deleteConfirm"),
 					cancelLabel: t("confirm.cancel"),
 					busy: deleteBusy,
 					returnFocus: deleteReturnFocusRef.current,
@@ -3254,6 +3288,7 @@ window.__ModuleLoader__.load({
 			const [selected, setSelected] = _react.useState(() => new Set());
 			const [tagFilter, setTagFilter] = _react.useState("");
 			const [metadataStatus, setMetadataStatus] = _react.useState("ready");
+			const [archiveTrashStatus, setArchiveTrashStatus] = _react.useState("ready");
 			const [stats, setStats] = _react.useState({ status: "idle", summary: null, sessions: {} });
 				const [metadataEdit, setMetadataEdit] = _react.useState(null);
 				const [metaBusy, setMetaBusy] = _react.useState(false);
@@ -3273,7 +3308,7 @@ window.__ModuleLoader__.load({
 				const trashReturnFocusRef = _react.useRef(null);
 				const metaReturnFocusRef = _react.useRef(null);
 					const importInputRef = _react.useRef(null);
-					const searchRequestRef = _react.useRef(0);
+					const searchRequestRef = _react.useRef({ sequence: 0, controller: null });
 					const previewReturnFocusRef = _react.useRef(null);
 					const previewRequestRef = _react.useRef({ sequence: 0, controller: null });
 
@@ -3341,6 +3376,7 @@ window.__ModuleLoader__.load({
 					const loaded = await fetchState();
 					setSessions(loaded.sessions);
 					setMetadataStatus(loaded.metadataStatus);
+					setArchiveTrashStatus(loaded.trashStatus);
 					setStats({ status: "idle", summary: null, sessions: {} });
 				} catch (error) {
 					setLoadError(error);
@@ -3406,16 +3442,18 @@ window.__ModuleLoader__.load({
 				}, [sessions, t]);
 				_react.useEffect(() => {
 					const trimmed = query.trim();
-					const requestId = searchRequestRef.current + 1;
-					searchRequestRef.current = requestId;
+					const current = searchRequestRef.current;
+					current.controller?.abort();
+					const request = { sequence: current.sequence + 1, controller: new AbortController() };
+					searchRequestRef.current = request;
 					if (Array.from(trimmed).length < 2) {
 						setContentSearch({ status: "idle", query: trimmed, hits: [], skipped: [] });
-						return undefined;
+						return () => request.controller.abort();
 					}
 					setContentSearch({ status: "loading", query: trimmed, hits: [], skipped: [] });
 					const timer = setTimeout(() => {
-						fetchArchiveSearch(trimmed, 100).then((result) => {
-							if (searchRequestRef.current !== requestId) return;
+						fetchArchiveSearch(trimmed, 100, request.controller.signal).then((result) => {
+							if (searchRequestRef.current !== request || request.controller.signal.aborted) return;
 							setContentSearch({
 								status: "ready",
 								query: trimmed,
@@ -3423,11 +3461,11 @@ window.__ModuleLoader__.load({
 								skipped: Array.isArray(result?.skipped) ? result.skipped : [],
 							});
 						}).catch(() => {
-							if (searchRequestRef.current !== requestId) return;
+							if (searchRequestRef.current !== request || request.controller.signal.aborted) return;
 							setContentSearch({ status: "error", query: trimmed, hits: [], skipped: [] });
 						});
 					}, 300);
-					return () => clearTimeout(timer);
+					return () => { clearTimeout(timer); request.controller.abort(); };
 				}, [query]);
 				_react.useEffect(() => {
 				if (sessions === null) return;
@@ -3878,7 +3916,9 @@ window.__ModuleLoader__.load({
 			}, [sessions, query, projectFilter, typeFilter, tagFilter, sortMode, contentHits, t]);
 
 			if (sessions === null && loadError === null) {
-				return (0, jsx.jsx)("div", { className: "dac-center", children: [(0, jsx.jsx)("span", { className: "dac-spin" }), (0, jsx.jsx)("span", { children: t("state.loading") })] });
+				// jsxs is the runtime for a static children array; jsx would make React
+				// treat it as a dynamic list and warn about missing keys on every open.
+				return (0, jsx.jsxs)("div", { className: "dac-center", children: [(0, jsx.jsx)("span", { className: "dac-spin" }), (0, jsx.jsx)("span", { children: t("state.loading") })] });
 			}
 			if (loadError !== null && sessions === null) {
 				return (0, jsx.jsxs)("div", {
@@ -3986,6 +4026,11 @@ window.__ModuleLoader__.load({
 						role: "status",
 						children: t("meta.unavailable")
 					}),
+					archiveTrashStatus === "unavailable" && (0, jsx.jsx)("div", {
+						className: "dac-warn",
+						role: "status",
+						children: t("trash.listUnverified")
+					}),
 					(0, jsx.jsxs)("div", {
 						className: "dac-search",
 						children: [

package/lib/durable.js

@@ -0,0 +1,99 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+const DIRECTORY_SYNC_UNSUPPORTED = new Set(['EINVAL', 'ENOTSUP']);
+const WINDOWS_DIRECTORY_SYNC_UNSUPPORTED = new Set(['EACCES', 'EISDIR', 'EPERM']);
+/**
+ * Windows has no atomic-replace guarantee while another handle is open on the
+ * destination — an indexer or antivirus scan is enough to fail the rename with
+ * EPERM/EACCES/EBUSY. These are transient, so the replace is retried briefly.
+ * POSIX rename never reports them for this operation, so the loop is a no-op.
+ */
+const RENAME_RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+const RENAME_ATTEMPTS = 10;
+const RENAME_DELAY_MS = 20;
+
+function directorySyncUnsupported(error) {
+  return DIRECTORY_SYNC_UNSUPPORTED.has(error?.code)
+    || (process.platform === 'win32' && WINDOWS_DIRECTORY_SYNC_UNSUPPORTED.has(error?.code));
+}
+
+/** Flush a file after it has been written. `r+` is supported on Windows. */
+export async function syncFile(path, openFile = open) {
+  const handle = await openFile(path, 'r+');
+  try { await handle.sync(); } finally { await handle.close(); }
+}
+
+/** Flush directory-entry changes where the platform exposes directory fsync. */
+export async function syncDirectory(path, openFile = open) {
+  let handle;
+  try { handle = await openFile(path, 'r'); }
+  catch (error) {
+    if (directorySyncUnsupported(error)) return false;
+    throw error;
+  }
+  try {
+    await handle.sync();
+    return true;
+  } catch (error) {
+    if (directorySyncUnsupported(error)) return false;
+    throw error;
+  } finally {
+    await handle.close();
+  }
+}
+
+/**
+ * Replace one file by rename, retrying only the transient Windows codes. On
+ * POSIX these codes are permanent conditions, so retrying there would just add
+ * latency before the same failure.
+ */
+export async function replaceFile(tempPath, filePath, {
+  renameFile = rename,
+  platform = process.platform,
+  delayMs = RENAME_DELAY_MS,
+  attempts = RENAME_ATTEMPTS,
+} = {}) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await renameFile(tempPath, filePath);
+      return attempt;
+    } catch (error) {
+      if (attempt >= attempts || platform !== 'win32' || !RENAME_RETRY_CODES.has(error?.code)) throw error;
+      await new Promise((resolve) => { setTimeout(resolve, delayMs * attempt); });
+    }
+  }
+}
+
+/** Atomically replace one private file and make the rename crash-durable. */
+export async function atomicWriteFile(filePath, data, { encoding = undefined } = {}) {
+  const directory = dirname(filePath);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  let tempPath = null;
+  try {
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+      const candidate = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        await writeFile(candidate, data, {
+          ...(encoding === undefined ? {} : { encoding }),
+          mode: 0o600,
+          flag: 'wx',
+        });
+        tempPath = candidate;
+        break;
+      } catch (error) {
+        await rm(candidate, { force: true }).catch(() => undefined);
+        if (error?.code !== 'EEXIST' || attempt === 7) throw error;
+      }
+    }
+    await chmod(tempPath, 0o600);
+    await syncFile(tempPath);
+    await replaceFile(tempPath, filePath);
+    tempPath = null;
+    await syncDirectory(directory);
+  } finally {
+    if (tempPath !== null) await rm(tempPath, { force: true }).catch(() => undefined);
+  }
+}

package/lib/export.js

@@ -14,6 +14,17 @@ function codePoints(value) {
   return [...value];
 }
 
+/**
+ * Neutralize a Windows device name. The reservation covers every extension too
+ * (`NUL.txt` is the device), so the marker has to change the base name instead
+ * of trailing the whole segment.
+ */
+function deviceSafe(segment) {
+  if (!RESERVED_BASENAME.test(segment)) return segment;
+  const dot = segment.indexOf('.');
+  return dot === -1 ? `${segment}-file` : `${segment.slice(0, dot)}-file${segment.slice(dot)}`;
+}
+
 /** Normalize untrusted text into one cross-platform archive path segment. */
 export function safeSegment(value, fallback = 'untitled', maxLength = 80) {
   const limit = Number.isInteger(maxLength) && maxLength > 0 ? maxLength : 80;
@@ -25,13 +36,13 @@ export function safeSegment(value, fallback = 'untitled', maxLength = 80) {
     .replace(/^[. -]+|[. -]+$/g, '');
 
   if (segment === '') segment = String(fallback).normalize('NFKC');
-  if (RESERVED_BASENAME.test(segment)) segment = `${segment}-file`;
 
+  // Truncate first: shortening can itself expose a reserved base name, and the
+  // marker is applied exactly once afterwards so it never stacks.
   segment = codePoints(segment).slice(0, limit).join('')
     .replace(/^[. -]+|[. -]+$/g, '');
   if (segment === '') return 'untitled';
-  if (RESERVED_BASENAME.test(segment)) return `${segment}-file`;
-  return segment;
+  return deviceSafe(segment);
 }
 
 function nullableString(value) {
@@ -237,6 +248,12 @@ function messageLabel(message) {
   return 'System';
 }
 
+function isoTimestamp(value) {
+  if (!Number.isFinite(value)) return null;
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : null;
+}
+
 /** Render the durable human transcript from append-origin Harness messages. */
 export function renderTranscript(item, events, exportedAt) {
   const lines = [
@@ -262,9 +279,8 @@ export function renderTranscript(item, events, exportedAt) {
     if (!isAppendSurfaceEvent(event)) continue;
     const message = deriveEventMessage(event);
     if (message === null) continue;
-    const timestamp = Number.isFinite(event.time)
-      ? ` - ${new Date(event.time).toISOString()}`
-      : '';
+    const isoTime = isoTimestamp(event.time);
+    const timestamp = isoTime === null ? '' : ` - ${isoTime}`;
     const content = Array.isArray(message.content)
       ? message.content.map(renderContentBlock).filter(Boolean).join('\n\n')
       : fenced('json', jsonText(message.content));