dsh-archived-chats 1.0.3 → 1.0.4

package/README.md

@@ -76,7 +76,7 @@ Features activate from the public capabilities exposed by the DeepSeek Harness H
 | --- | --- |
 | Archive and session reads | Browsing, search, preview, History inventory, storage accounting, and lineage. |
 | Attachment reads | Stored images appear in conversation and snapshot previews; without it, text remains readable. |
-| Public persistence writer | Required for ZIP import, **Restore as copy**, and snapshot fallback when an original is missing. |
+| Public session writer | ZIP import, **Restore as copy**, and snapshot fallback when an original is missing all write through the Host's public `create` / `append` / `locate` capability, or a dedicated restore entry point where one exists. |
 | Missing write capability | The operation returns `restore-unsupported` without writing or overwriting data. |
 
 Back up `$DSH_HOME/plugin-data/archived-chats/` before downgrading to a release that does not display History or understand recycle snapshots.

package/README.zh-CN.md

@@ -76,7 +76,7 @@ dsh plugin --profile web update dsh-archived-chats
 | --- | --- |
 | 归档与会话读取 | 浏览、搜索、预览、历史清单、空间分账和会话血缘。 |
 | 附件读取 | 对话和快照预览可显示已存储图片；缺少时文本内容仍可阅读。 |
-| 公开持久层 writer | ZIP 导入、**恢复为副本**，以及原件丢失时的快照回退恢复需要此能力。 |
+| 公开会话 writer | ZIP 导入、**恢复为副本** 和原件丢失时的快照回退，都通过 Host 公开的 `create` / `append` / `locate` 能力写入；Host 提供专用恢复入口时优先使用。 |
 | 缺少写入能力 | 操作返回 `restore-unsupported`，不会写入或覆盖数据。 |
 
 降级到不显示历史版本或不识别回收快照的版本前，请备份 `$DSH_HOME/plugin-data/archived-chats/`。

package/docs/ARCHITECTURE.en.md

@@ -86,7 +86,7 @@ Cross-session persistence inspection is limited to four concurrent reads, stops
 
 `history-restore.js` fully validates the snapshot, asks the Host for a new session ID, and issues a five-minute single-use token/nonce. Confirmation consumes the credential before writes and rechecks the manifest, then creates persistence, rewrites session/attachment identities, appends events, restores workspace and metadata, and commits archive registry state last. Failures reverse plugin-controlled steps. The source session and snapshot never change, and the plugin makes no claim that Host-global attachment objects were deleted.
 
-Single-version deletion and **Clear history versions** both enter the shared lifecycle queue and bypass the ordinary 30-second cache/in-flight list so current snapshot and recycle-protection state is recomputed. Single deletion rejects `recycle-protection`; clear removes only healthy ordinary history and skips recycle-protection and degraded snapshots. Deletion physically removes the plugin snapshot and its attachment copies, so that version can no longer be previewed or restored, while the original chat and other versions remain unchanged.
+Single-version deletion and **Clear history versions** both enter the shared lifecycle queue and bypass the ordinary 30-second cache/in-flight list so current snapshot and recycle-protection state is recomputed. Both reject a snapshot a recycle record still names, degraded or not — that record is its last claim. Both otherwise accept a degraded snapshot: it can no longer be previewed or restored from, but its bytes are still on disk and no other surface can reclaim them (retention plans only healthy snapshots), so refusing here would leak the store permanently. Deletion physically removes the plugin snapshot and its attachment copies, while the original chat and other versions remain unchanged.
 
 ## Export flow
 
@@ -113,19 +113,19 @@ import/inspect accepts only version-one ZIPs produced by this plugin. The Host s
 5. restore.js uses a feature-detected adapter to write sessions, metadata, and archive state.
 6. Any failure rolls back staged data and never overwrites an existing session.
 
-The confirmation token expires quickly, can be used once, and is bounded to eight retained plans and 128 MiB total per process. Confirmation-time conflict revalidation, staging, and commit all run inside the shared lifecycle queue. Import is enabled only when the Host exposes writer, removal rollback, archive, and metadata capabilities; workspace attach is used only with a matching detach, otherwise the item restores ungrouped with a warning. A boundary that throws after changing state is compensated in reverse order; failed compensation is reported explicitly rather than returning false success.
+The confirmation token expires quickly, can be used once, and is bounded to eight retained plans and 128 MiB total per process. Confirmation-time conflict revalidation, staging, and commit all run inside the shared lifecycle queue. Import resolves a session writer by capability: a dedicated Host restore entry point when one exists, otherwise the ordinary `create` / `append` / `locate` surface — the same capability History restore-as-copy writes through, so import works wherever that works. The append writer carries its own session-scoped rollback (it confirms the located directory is the session's own before creating anything), so a separate removal capability is required only for a dedicated restore entry point. Archive and metadata write capabilities are still required. The staged id does not exist yet, so a session reader that fails closed on unknown ids is the expected answer to the capability probe and never aborts the restore. Workspace attach is used only with a matching detach, otherwise the item restores ungrouped with a warning. A boundary that throws after changing state is compensated in reverse order; failed compensation is reported explicitly rather than returning false success.
 
 ## Recycle and protection-snapshot lifecycle
 
 `trash.json` permits only `trashed`, `purge-pending`, and `degraded`. Legal transitions are `missing -> trashed`, `trashed/degraded -> purge-pending`, and removal of an existing state after a committed transaction. A `purge-pending` record cannot restore.
 
-Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits are 4 MiB manifest, 64 MiB session JSON, 1,000 attachments, 32 MiB each, and 512 MiB total. Restore validation streams attachment digests first and rereads one attachment at a time immediately before Host writes, never retaining all attachment bytes together. Snapshot publication/deletion and state-file renames sync file and parent-directory durability, with a safe fallback on Windows filesystems that do not expose directory fsync.
+Protection manifests use `dsh-archived-chats/snapshot` v1 and session payloads use `dsh-archived-chats/snapshot-session` v1. Each recycle record names one active snapshot; older valid snapshots from restore/recycle cycles remain history until explicit retention application or permanent purge. Exact limits are 4 MiB manifest, 64 MiB session JSON, 1,000 attachments, 32 MiB each, and 512 MiB total. Restore validation streams attachment digests first and rereads one attachment at a time immediately before Host writes, never retaining all attachment bytes together. Snapshot publication/deletion and state-file renames sync file and parent-directory durability, with a safe fallback on Windows filesystems that do not expose directory fsync. Windows cannot atomically replace a file or remove a directory entry while another handle is open on it — an indexer or antivirus scan is enough — so replaces and recursive removals retry the transient `EPERM` / `EACCES` / `EBUSY` codes there, bounded, and only there: on POSIX the same codes are permanent conditions and retrying would only delay the same failure. Snapshot publication also treats a rename refused onto an existing directory as a conflict after probing the destination, because Windows reports that as `EPERM` rather than `EEXIST`. Path containment is tested with the platform separator and rejects an absolute answer, so a Windows `..\` escape or a different drive letter cannot read as inside the root.
 
 Move ordering is: validate archive ownership → dispose or park a live session → capture and verify snapshot → recheck ownership → atomically commit `trashed` → invalidate caches. Ordinary move never removes the persistence artifact.
 
 Restore first rejects an existing-ID conflict. With an intact original it restores archive visibility and removes only the recycle record, without rewriting persistence; the snapshot remains history. With a missing original it completes validation and attachment-identity republishing before writing through public `create` / `append` / `saveImage` capabilities. A failure rolls back the new artifact and retains trash.
 
-Permanent purge persists `purge-pending` before physical writes, then removes the original, every validated snapshot for that source, and the recycle record. Workspace, metadata, snapshot, or physical-delete failures retain `purge-pending`; snapshot deletion is rescanned before success can be returned. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
+Permanent purge persists `purge-pending` before physical writes, then removes every snapshot for that source, then the original session, and finally the recycle record. The session delete is deliberately last: a failure before it leaves the original intact and the record completable, rather than a `purge-pending` record whose session is already gone and which can therefore neither restore nor complete. The snapshot sweep attributes each published snapshot by manifest identity so a snapshot that fails validation is still removed when it belongs to this session, and an unrelated unverifiable snapshot is skipped instead of aborting the sweep — corruption elsewhere in the store must never make a purge impossible. The recycle record also names its own snapshot id, covering one damaged past attribution. Workspace, metadata, snapshot, or physical-delete failures retain `purge-pending`; snapshot deletion is rescanned before success can be returned. Physical deletion additionally requires the located artifact to sit in a directory named for the session itself, so a backend layout that shares one parent between sessions can never have that parent removed. Startup recovery retries only `purge-pending`, never plain `trashed`. Legacy `pending-deletions.json` is strict read-only migration input: each still-archived ID becomes recoverable trash and is never boot-deleted merely because of the old marker.
 
 ## Browser client
 
@@ -158,7 +158,7 @@ The browser never mutates files directly. After an operation, the Host response
 
 ## Compatibility and testing
 
-The plugin adapts through Host capability detection: archive reads, attachment reads, persistence writes, and live-session lifecycle support are evaluated independently, and missing capabilities must degrade safely or return explicit errors. Import, History restore-as-copy, and snapshot fallback when the original is missing require a public writer; without it they return `restore-unsupported` without mutation. Back up the complete plugin-data directory before downgrading to a release that does not display History or understand recycle snapshots.
+The plugin adapts through Host capability detection: archive reads, attachment reads, persistence writes, and live-session lifecycle support are evaluated independently, and missing capabilities must degrade safely or return explicit errors. Import, History restore-as-copy, and snapshot fallback when the original is missing all write through the public `create` / `append` / `locate` capability, or a dedicated restore entry point where the Host offers one; only a Host exposing neither returns `restore-unsupported` without mutation. A capability set that no shipped Host satisfies is not an acceptable guard — it makes the feature permanently dead rather than gracefully degraded. Back up the complete plugin-data directory before downgrading to a release that does not display History or understand recycle snapshots.
 
 Coverage includes:
 

package/docs/ARCHITECTURE.md

@@ -86,7 +86,7 @@ preview/image 的授权顺序固定为：先验证 POST 和 `x-dsh-archived-chat
 
 `history-restore.js` 先完整验证快照，用 Host 生成新会话 ID，再签发五分钟、单次使用的 token/nonce。确认时先消费凭据并重验 manifest；然后依次创建持久会话、重写会话/附件身份、附加事件、恢复工作区和元数据，最后才写入归档注册表。任一插件控制的边界失败都按逆序回滚；来源会话与快照始终不变，也不声称删除了 Host 全局附件对象。
 
-历史页的单条删除与「清空历史版本」都进入共用生命周期队列，并绕过普通 30 秒缓存/进行中请求，重新计算当前快照与回收保护关系。单条删除拒绝 `recycle-protection`；清空只删除健康普通历史，跳过回收保护和降级快照。删除会物理移除插件快照及其附件副本，无法再预览或恢复，但不修改原聊天或其他版本。
+历史页的单条删除与「清空历史版本」都进入共用生命周期队列，并绕过普通 30 秒缓存/进行中请求，重新计算当前快照与回收保护关系。两者都拒绝仍被回收记录引用的快照（无论是否降级）——那条记录是它最后的归属。除此之外两者都接受降级快照：它已无法预览或恢复，但字节仍在磁盘上，而其他任何入口都无法回收它们（保留策略只规划健康快照），在这里拒绝就意味着永久泄漏。删除会物理移除插件快照及其附件副本，但不修改原聊天或其他版本。
 
 ## 导出流程
 
@@ -113,19 +113,19 @@ import/inspect 只接受本插件版本一导出的 ZIP。Host 以有界压缩
 5. restore.js 通过能力探测的适配器写入会话、元数据和归档状态。
 6. 任一步骤失败都回滚暂存数据，不覆盖已有会话。
 
-确认令牌短期有效且只能使用一次，并受 8 条、总计 128 MiB 的进程内保留上限约束。确认后的冲突重检、暂存和提交全部进入共享生命周期队列。只有同时提供 writer、删除回滚、归档和元数据能力的宿主才会启用导入；工作区 attach 必须有对应 detach，否则按未分组警告处理。任一边界即使在抛错前已经改变状态，也会按逆序补偿；无法完成补偿时明确返回 rollback failed，而不会报告恢复成功。
+确认令牌短期有效且只能使用一次，并受 8 条、总计 128 MiB 的进程内保留上限约束。确认后的冲突重检、暂存和提交全部进入共享生命周期队列。导入按能力解析会话 writer：有专用恢复入口时优先使用，否则使用普通的 `create` / `append` / `locate` 面——也就是历史版本恢复为副本写入所用的同一能力，因此后者能工作的地方导入就能工作。append writer 自带会话作用域回滚（创建任何东西之前先确认定位到的目录属于该会话本身），所以只有专用恢复入口才需要额外的删除能力；归档与元数据写入能力仍然必需。待恢复 id 尚不存在，因此对未知会话 fail-closed 的读取器正是能力探测的预期回答，不会中断恢复。工作区 attach 必须有对应 detach，否则按未分组警告处理。任一边界即使在抛错前已经改变状态，也会按逆序补偿；无法完成补偿时明确返回 rollback failed，而不会报告恢复成功。
 
 ## 回收与保护快照生命周期
 
 `trash.json` 的合法状态只有 `trashed`、`purge-pending`、`degraded`。合法转换为 `missing -> trashed`、`trashed/degraded -> purge-pending`，以及任一现有状态在事务成功后移除。`purge-pending` 不得恢复。
 
-保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 64 MiB、1,000 个附件、单附件 32 MiB、总计 512 MiB；恢复验证先流式校验附件摘要，再在写入 Host 前逐件复读，绝不同时保留全部附件字节。发布、删除与状态文件的 rename 会同步文件和父目录；不支持目录 fsync 的 Windows 文件系统安全降级。
+保护快照格式是 `dsh-archived-chats/snapshot` v1，会话载荷是 `dsh-archived-chats/snapshot-session` v1。每个回收记录只引用一个活跃快照，重复恢复/回收产生的旧有效快照保留为历史，直到明确应用保留策略或永久删除。精确上限为：manifest 4 MiB、session JSON 64 MiB、1,000 个附件、单附件 32 MiB、总计 512 MiB；恢复验证先流式校验附件摘要，再在写入 Host 前逐件复读，绝不同时保留全部附件字节。发布、删除与状态文件的 rename 会同步文件和父目录；不支持目录 fsync 的 Windows 文件系统安全降级。Windows 在目标仍被其他句柄打开时无法原子替换文件或移除目录项（索引服务或杀毒扫描即可导致），因此替换与递归删除会在该平台上、且仅在该平台上，对瞬时的 `EPERM` / `EACCES` / `EBUSY` 做有界重试：POSIX 上这些码表示永久条件，重试只会延后同一个失败。快照发布还会在 rename 被拒时探测目标目录再判定为冲突，因为 Windows 把「rename 到已存在目录」报成 `EPERM` 而不是 `EEXIST`。路径包含判定使用平台分隔符并拒绝绝对结果，因此 Windows 的 `..\` 逃逸或不同盘符都不会被误判为在根目录内。
 
 移入顺序为：校验归档所有权 → 处置/停放运行中会话 → 捕获并验证快照 → 再次校验所有权 → 原子写入 `trashed` 记录 → 使缓存失效。普通移入不删除持久层文件。
 
 恢复先检查同 ID 冲突。原会话完好时只恢复归档可见性并移除回收记录，不重写持久层，保护快照保留为历史；原件丢失时先完成所有校验和附件身份重发，然后仅通过公开 `create` / `append` / `saveImage` 能力写入。失败会回滚新建件并保留回收记录。
 
-永久删除在任何物理写入前持久化 `purge-pending`，再删除原会话、该来源的全部已验证快照和回收记录。工作区、元数据、快照或物理删除任一步骤失败时都保留 `purge-pending`；快照删除后还会重新扫描确认，不会虚假报告成功。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
+永久删除在任何物理写入前持久化 `purge-pending`，接着删除该来源的全部快照，然后删除原会话，最后移除回收记录。会话删除刻意放在最后：在它之前失败会保留完好的原件和可继续完成的记录，而不是留下一条会话已消失、既不能恢复也不能完成的 `purge-pending`。快照清扫按 manifest 身份归属每个已发布快照，因此校验失败但确属该会话的快照仍会被删除，而无关的无法校验快照会被跳过而不是中断整个清扫——快照库别处的损坏绝不能让永久删除变成不可能。回收记录还会点名自己的快照 id，覆盖损坏到无法归属的那一个。工作区、元数据、快照或物理删除任一步骤失败时都保留 `purge-pending`；快照删除后还会重新扫描确认，不会虚假报告成功。物理删除另外要求定位到的文件位于以该会话自身命名的目录中，因此当后端布局让多个会话共享同一父目录时，那个父目录永远不会被删除。启动恢复仅重试 `purge-pending`，从不删除普通 `trashed`。旧 `pending-deletions.json` 是严格、只读的迁移输入：每个仍归档的 ID 都转成可恢复回收记录，绝不因旧标记在启动时直接删除。
 
 ## 浏览器客户端
 
@@ -158,7 +158,7 @@ client.js 注册 order 30 的 settings.section，并使用 Harness 公开的浮
 
 ## 兼容性和测试
 
-插件通过能力检测适配 Host：归档读取、附件读取、持久层写入和运行中会话生命周期能力分别判断，缺失能力必须安全降级或返回明确错误。导入、历史版本恢复为副本和原件丢失时的快照回退需要公开 writer；缺少时返回 `restore-unsupported` 且不写入数据。旧版若不显示历史页或不识别回收快照，降级前应备份整个插件数据目录。
+插件通过能力检测适配 Host：归档读取、附件读取、持久层写入和运行中会话生命周期能力分别判断，缺失能力必须安全降级或返回明确错误。导入、历史版本恢复为副本和原件丢失时的快照回退都通过公开的 `create` / `append` / `locate` 能力写入，Host 提供专用恢复入口时优先使用；只有两者都不存在才返回 `restore-unsupported` 且不写入数据。要求一组没有任何已发布 Host 能满足的能力不是合格的守卫——那会让功能永久失效，而不是优雅降级。旧版若不显示历史页或不识别回收快照，降级前应备份整个插件数据目录。
 
 测试覆盖：
 

package/lib/client.js

@@ -261,6 +261,9 @@ window.__ModuleLoader__.load({
 				"history.scope.history-only": "仅历史保留",
 				"history.degraded": "无法读取的历史版本",
 				"history.degradedItem": "无法验证",
+				"history.degradedDelete": "清除",
+				"history.degradedDeleteTitle": "清除这个无法读取的历史版本？",
+				"trash.listUnverified": "回收站目录无法读取：下面的列表可能包含已删除的聊天，归档修改已暂停。",
 				"insights.loading": "正在分析空间…",
 				"insights.error": "空间分析暂不可用",
 				"insights.scopeNote": "这里只统计已归档、回收站会话，以及本插件为它们创建并继续保留的恢复快照。恢复聊天后快照仍可保留，所以归档列表为空时这里仍可能有数据。",
@@ -522,6 +525,9 @@ window.__ModuleLoader__.load({
 				"history.scope.history-only": "History only",
 				"history.degraded": "Unreadable history versions",
 				"history.degradedItem": "Could not verify",
+				"history.degradedDelete": "Reclaim",
+				"history.degradedDeleteTitle": "Reclaim this unreadable history version?",
+				"trash.listUnverified": "The Recycle Bin catalog is unreadable: this list may include deleted chats, and archive changes are paused.",
 				"insights.loading": "Analyzing storage…",
 				"insights.error": "Storage insights are unavailable",
 				"insights.scopeNote": "This page measures archived and recycled chats plus recovery snapshots this plugin created and retained for them. Restoring a chat may retain its snapshot, so storage can remain when the archive list is empty.",
@@ -1408,6 +1414,10 @@ window.__ModuleLoader__.load({
 			return {
 				sessions: Array.isArray(body.sessions) ? body.sessions : [],
 				metadataStatus: body.metadataStatus === "unavailable" ? "unavailable" : "ready",
+				// An unreadable recycle catalog cannot be subtracted from this list, so
+				// already-deleted chats can reappear here. Surface it instead of
+				// silently showing them as ordinary archived chats.
+				trashStatus: body.trashStatus === "unavailable" ? "unavailable" : "ready",
 			};
 		}
 
@@ -3082,6 +3092,14 @@ window.__ModuleLoader__.load({
 				setDeleteDialog({ kind: "one", session, version });
 				setMessage(null);
 			};
+			// Unreadable versions still occupy the snapshot store, so they need their
+			// own reclaim path — they never appear as a restorable version row.
+			const askDeleteDegraded = (item) => {
+				if (deleteBusy || restoreDialog !== null) return;
+				deleteReturnFocusRef.current = document.activeElement;
+				setDeleteDialog({ kind: "degraded", item });
+				setMessage(null);
+			};
 			const askClearHistory = () => {
 				if (clearSummary.versionCount === 0 || deleteBusy || restoreDialog !== null) return;
 				deleteReturnFocusRef.current = document.activeElement;
@@ -3093,9 +3111,9 @@ window.__ModuleLoader__.load({
 				const current = deleteDialog;
 				setDeleteBusy(true);
 				try {
-					const result = current.kind === "one"
-						? await deleteHistoryVersion(current.version.snapshotId)
-						: await clearHistoryVersions();
+					const result = current.kind === "all"
+						? await clearHistoryVersions()
+						: await deleteHistoryVersion(current.kind === "degraded" ? current.item.snapshotId : current.version.snapshotId);
 					setDeleteDialog(null);
 					await load();
 					const deletedCount = Array.isArray(result?.deleted) ? result.deleted.length : 0;
@@ -3116,7 +3134,11 @@ window.__ModuleLoader__.load({
 					setDeleteBusy(false);
 				}
 			};
-			const deleteBody = deleteDialog === null ? "" : deleteDialog.kind === "one"
+			const deleteBody = deleteDialog === null ? "" : deleteDialog.kind === "degraded"
+				? (isZh(t)
+					? `该历史版本已无法读取或校验，不能再用于恢复。清除后将释放它占用的磁盘空间；原聊天不会被删除。`
+					: `This history version can no longer be read or verified, so it cannot be restored from. Reclaiming it frees the disk space it still occupies. The original chat is not deleted.`)
+				: deleteDialog.kind === "one"
 				? (() => {
 					const title = deleteDialog.session.title || t("chat.untitled");
 					const createdMs = Date.parse(deleteDialog.version.createdAt);
@@ -3210,6 +3232,13 @@ window.__ModuleLoader__.load({
 					...state.degraded.map((item) => (0, jsx.jsxs)("div", { className: "dac-history-degraded-row", children: [
 						(0, jsx.jsx)("code", { children: item.snapshotId }),
 						(0, jsx.jsx)("span", { children: t("history.degradedItem") }),
+						(0, jsx.jsx)("button", {
+							type: "button",
+							className: "dac-btn dac-history-delete",
+							disabled: deleteBusy || deleteDialog !== null || restoreDialog !== null,
+							onClick: () => askDeleteDegraded(item),
+							children: t("history.degradedDelete"),
+						}),
 					] }, item.snapshotId)),
 				] }),
 				restoreDialog !== null && (0, jsx.jsx)(ConfirmDialog, {
@@ -3225,9 +3254,9 @@ window.__ModuleLoader__.load({
 					onCancel: () => setRestoreDialog(null),
 				}),
 				deleteDialog !== null && (0, jsx.jsx)(ConfirmDialog, {
-					title: t(deleteDialog.kind === "one" ? "history.deleteTitle" : "history.clearTitle"),
+					title: t(deleteDialog.kind === "one" ? "history.deleteTitle" : deleteDialog.kind === "degraded" ? "history.degradedDeleteTitle" : "history.clearTitle"),
 					body: deleteBody,
-					confirmLabel: t(deleteDialog.kind === "one" ? "history.deleteConfirm" : "history.clear"),
+					confirmLabel: t(deleteDialog.kind === "all" ? "history.clear" : "history.deleteConfirm"),
 					cancelLabel: t("confirm.cancel"),
 					busy: deleteBusy,
 					returnFocus: deleteReturnFocusRef.current,
@@ -3259,6 +3288,7 @@ window.__ModuleLoader__.load({
 			const [selected, setSelected] = _react.useState(() => new Set());
 			const [tagFilter, setTagFilter] = _react.useState("");
 			const [metadataStatus, setMetadataStatus] = _react.useState("ready");
+			const [archiveTrashStatus, setArchiveTrashStatus] = _react.useState("ready");
 			const [stats, setStats] = _react.useState({ status: "idle", summary: null, sessions: {} });
 				const [metadataEdit, setMetadataEdit] = _react.useState(null);
 				const [metaBusy, setMetaBusy] = _react.useState(false);
@@ -3346,6 +3376,7 @@ window.__ModuleLoader__.load({
 					const loaded = await fetchState();
 					setSessions(loaded.sessions);
 					setMetadataStatus(loaded.metadataStatus);
+					setArchiveTrashStatus(loaded.trashStatus);
 					setStats({ status: "idle", summary: null, sessions: {} });
 				} catch (error) {
 					setLoadError(error);
@@ -3885,7 +3916,9 @@ window.__ModuleLoader__.load({
 			}, [sessions, query, projectFilter, typeFilter, tagFilter, sortMode, contentHits, t]);
 
 			if (sessions === null && loadError === null) {
-				return (0, jsx.jsx)("div", { className: "dac-center", children: [(0, jsx.jsx)("span", { className: "dac-spin" }), (0, jsx.jsx)("span", { children: t("state.loading") })] });
+				// jsxs is the runtime for a static children array; jsx would make React
+				// treat it as a dynamic list and warn about missing keys on every open.
+				return (0, jsx.jsxs)("div", { className: "dac-center", children: [(0, jsx.jsx)("span", { className: "dac-spin" }), (0, jsx.jsx)("span", { children: t("state.loading") })] });
 			}
 			if (loadError !== null && sessions === null) {
 				return (0, jsx.jsxs)("div", {
@@ -3993,6 +4026,11 @@ window.__ModuleLoader__.load({
 						role: "status",
 						children: t("meta.unavailable")
 					}),
+					archiveTrashStatus === "unavailable" && (0, jsx.jsx)("div", {
+						className: "dac-warn",
+						role: "status",
+						children: t("trash.listUnverified")
+					}),
 					(0, jsx.jsxs)("div", {
 						className: "dac-search",
 						children: [

package/lib/durable.js

@@ -4,6 +4,15 @@ import { dirname } from 'node:path';
 
 const DIRECTORY_SYNC_UNSUPPORTED = new Set(['EINVAL', 'ENOTSUP']);
 const WINDOWS_DIRECTORY_SYNC_UNSUPPORTED = new Set(['EACCES', 'EISDIR', 'EPERM']);
+/**
+ * Windows has no atomic-replace guarantee while another handle is open on the
+ * destination — an indexer or antivirus scan is enough to fail the rename with
+ * EPERM/EACCES/EBUSY. These are transient, so the replace is retried briefly.
+ * POSIX rename never reports them for this operation, so the loop is a no-op.
+ */
+const RENAME_RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+const RENAME_ATTEMPTS = 10;
+const RENAME_DELAY_MS = 20;
 
 function directorySyncUnsupported(error) {
   return DIRECTORY_SYNC_UNSUPPORTED.has(error?.code)
@@ -35,6 +44,28 @@ export async function syncDirectory(path, openFile = open) {
   }
 }
 
+/**
+ * Replace one file by rename, retrying only the transient Windows codes. On
+ * POSIX these codes are permanent conditions, so retrying there would just add
+ * latency before the same failure.
+ */
+export async function replaceFile(tempPath, filePath, {
+  renameFile = rename,
+  platform = process.platform,
+  delayMs = RENAME_DELAY_MS,
+  attempts = RENAME_ATTEMPTS,
+} = {}) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await renameFile(tempPath, filePath);
+      return attempt;
+    } catch (error) {
+      if (attempt >= attempts || platform !== 'win32' || !RENAME_RETRY_CODES.has(error?.code)) throw error;
+      await new Promise((resolve) => { setTimeout(resolve, delayMs * attempt); });
+    }
+  }
+}
+
 /** Atomically replace one private file and make the rename crash-durable. */
 export async function atomicWriteFile(filePath, data, { encoding = undefined } = {}) {
   const directory = dirname(filePath);
@@ -59,7 +90,7 @@ export async function atomicWriteFile(filePath, data, { encoding = undefined } =
     }
     await chmod(tempPath, 0o600);
     await syncFile(tempPath);
-    await rename(tempPath, filePath);
+    await replaceFile(tempPath, filePath);
     tempPath = null;
     await syncDirectory(directory);
   } finally {

package/lib/export.js

@@ -14,6 +14,17 @@ function codePoints(value) {
   return [...value];
 }
 
+/**
+ * Neutralize a Windows device name. The reservation covers every extension too
+ * (`NUL.txt` is the device), so the marker has to change the base name instead
+ * of trailing the whole segment.
+ */
+function deviceSafe(segment) {
+  if (!RESERVED_BASENAME.test(segment)) return segment;
+  const dot = segment.indexOf('.');
+  return dot === -1 ? `${segment}-file` : `${segment.slice(0, dot)}-file${segment.slice(dot)}`;
+}
+
 /** Normalize untrusted text into one cross-platform archive path segment. */
 export function safeSegment(value, fallback = 'untitled', maxLength = 80) {
   const limit = Number.isInteger(maxLength) && maxLength > 0 ? maxLength : 80;
@@ -25,13 +36,13 @@ export function safeSegment(value, fallback = 'untitled', maxLength = 80) {
     .replace(/^[. -]+|[. -]+$/g, '');
 
   if (segment === '') segment = String(fallback).normalize('NFKC');
-  if (RESERVED_BASENAME.test(segment)) segment = `${segment}-file`;
 
+  // Truncate first: shortening can itself expose a reserved base name, and the
+  // marker is applied exactly once afterwards so it never stacks.
   segment = codePoints(segment).slice(0, limit).join('')
     .replace(/^[. -]+|[. -]+$/g, '');
   if (segment === '') return 'untitled';
-  if (RESERVED_BASENAME.test(segment)) return `${segment}-file`;
-  return segment;
+  return deviceSafe(segment);
 }
 
 function nullableString(value) {

package/lib/history-restore.js

@@ -175,7 +175,7 @@ export function createHistoryRestoreService({
       await persistence.removeSession(destinationId);
       return;
     }
-    await rm(dirname(persistenceLocation.path), { recursive: true, force: true });
+    await rm(dirname(persistenceLocation.path), { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
   }
 
   async function restore(token, nonce) {
@@ -192,7 +192,7 @@ export function createHistoryRestoreService({
       if (currentIds.has(entry.destinationId)) throw failure('history-restore-conflict', 'history destination already exists', 409);
       const meta = structuredClone(checked.record.source.meta);
       meta.id = entry.destinationId;
-      const location = persistence.locate(meta);
+      const location = await persistence.locate(meta);
       if (typeof location?.path !== 'string' || basename(dirname(location.path)) !== entry.destinationId) {
         throw failure('history-restore-unsupported', 'history restore rollback location is unavailable', 501);
       }

package/lib/history.js

@@ -76,6 +76,23 @@ export function createHistoryService({
     cache = null;
   }
 
+  /**
+   * Snapshot ids a recycle record still points at. They protect a recycled
+   * session and must never be deleted from the History surface, degraded or
+   * not — the record is the only claim left on them.
+   */
+  async function protectedSnapshots() {
+    const trash = await trashStore.load();
+    if (trash?.status !== 'ready' || !(trash.records instanceof Map)) {
+      throw failure('history-authority-unavailable', 'history authority is unavailable', 503);
+    }
+    const ids = new Set();
+    for (const record of trash.records.values()) {
+      if (typeof record?.snapshotId === 'string' && record.snapshotId !== '') ids.add(record.snapshotId);
+    }
+    return ids;
+  }
+
   async function sourceRevision(sessionId, live) {
     if (typeof persistence.listSnapshots !== 'function') {
       if (live) throw failure('history-revision-unavailable', 'stable session revision is unavailable', 501);
@@ -276,14 +293,20 @@ export function createHistoryService({
     if (typeof snapshotStore.remove !== 'function') throw failure('history-delete-unsupported', 'history deletion is unavailable', 501);
     return lifecycle.run(async () => {
       invalidate();
-      const version = versionFromInventory(await compute(), snapshotId);
-      if (version.state === 'recycle-protection') {
+      const inventory = await compute();
+      // A degraded snapshot can no longer be read, so it is not a restorable
+      // version — but its bytes are still on disk and it must stay deletable,
+      // or the store leaks with no surface that can reclaim it.
+      const damaged = inventory.degraded.find((item) => item.snapshotId === snapshotId);
+      const version = damaged === undefined ? versionFromInventory(inventory, snapshotId) : null;
+      const protectedIds = await protectedSnapshots();
+      if (version?.state === 'recycle-protection' || protectedIds.has(snapshotId)) {
         throw failure('history-snapshot-protected', 'history snapshot protects a recycled session', 409);
       }
       try { await snapshotStore.remove(snapshotId); }
       catch { throw failure('history-delete-failed', 'history snapshot could not be deleted', 500); }
       invalidate();
-      return { deleted: [snapshotId], freedBytes: version.totalBytes };
+      return { deleted: [snapshotId], freedBytes: version?.totalBytes ?? 0 };
     });
   }
 
@@ -292,6 +315,7 @@ export function createHistoryService({
     return lifecycle.run(async () => {
       invalidate();
       const inventory = await compute();
+      const protectedIds = await protectedSnapshots();
       const deleted = [];
       const skipped = [];
       const failed = [];
@@ -315,7 +339,20 @@ export function createHistoryService({
         }
       }
       for (const item of inventory.degraded) {
-        skipped.push({ snapshotId: item.snapshotId, reason: 'history-snapshot-degraded' });
+        if (protectedIds.has(item.snapshotId)) {
+          skipped.push({ snapshotId: item.snapshotId, reason: 'history-snapshot-protected' });
+          continue;
+        }
+        // Unreadable bytes still occupy the store: clearing history reclaims them.
+        try {
+          await snapshotStore.remove(item.snapshotId);
+          deleted.push(item.snapshotId);
+        } catch (error) {
+          failed.push({
+            snapshotId: item.snapshotId,
+            reason: typeof error?.code === 'string' && error.code !== '' ? error.code : 'history-delete-failed',
+          });
+        }
       }
       invalidate();
       return { deleted, freedBytes, skipped, failed };

package/lib/index.js

@@ -54,14 +54,14 @@
  * original conservative behavior: the agent is left parked (cancelled,
  * flushed) and the id is recorded in a small pending-deletions store while
  * KEEPING it archived so it stays invisible. The boot sweep
- * (`sweepPendingDeletions`, launched once when the plugin's three services
- * have all bound) completes the removal through the ordinary cold delete path
- * on the next boot — when every session is cold. The pending store also
- * brackets the successful live path (recorded before disposal, cleared after
- * the files are gone), so a crash mid-delete is swept on the next boot
- * instead of leaving a half-deleted ghost. Unarchiving a parked session drops
- * it from the pending store, and the sweep skips ids that are no longer
- * archived, so an unarchive always wins over a parked deletion.
+ * (`recycleService.recoverStartup`, launched once when the plugin's three
+ * services have all bound) migrates those ids into the recoverable recycle
+ * catalog and retries only records carrying durable `purge-pending` intent.
+ * The pending store also brackets the successful live path (recorded before
+ * disposal, cleared after the files are gone), so a crash mid-delete is swept
+ * on the next boot instead of leaving a half-deleted ghost. Unarchiving a
+ * parked session drops it from the pending store, and the sweep skips ids that
+ * are no longer archived, so an unarchive always wins over a parked deletion.
  *
  * Routes bind lazily (same posture as dsh-agent-teams): the web server, the
  * workspace registry, and session persistence may mount after this plugin
@@ -73,7 +73,7 @@
 import { lstat, readFile, rm } from 'node:fs/promises';
 import { readFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { createMetadataStore, MetadataStoreError } from './metadata.js';
 import { createStatsService } from './stats.js';
@@ -111,6 +111,13 @@ const ROUTE_PREFIX = '/plugins/dsh-archived-chats';
 /** Custom header required on POSTs: cheap CSRF hardening for a loopback UI. */
 const GUARD_HEADER = 'x-dsh-archived-chats';
 
+/**
+ * Windows keeps a deleted directory entry alive while any handle is open (an
+ * indexer or antivirus scan is enough), surfacing as EBUSY/EPERM/ENOTEMPTY.
+ * Retrying is the documented remedy and is harmless on POSIX.
+ */
+const RM_RETRY = Object.freeze({ maxRetries: 5, retryDelay: 50 });
+
 function readPluginVersion() {
     const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
     if (typeof manifest.version !== 'string' || manifest.version === '') {
@@ -572,6 +579,20 @@ async function listArchived(ctx, registry, persistence, titleCache, metadataStor
     };
 }
 
+/**
+ * Read one trash record, failing CLOSED when the store is unreadable. A
+ * corrupt trash document must never let a mutation treat a recycled session as
+ * an ordinary archived one — the recycle record would survive the change and a
+ * later purge would delete a chat the user had put back into service.
+ */
+async function requireTrashRecord(trashStore, id) {
+    const trash = await trashStore.load();
+    if (trash.status !== 'ready') {
+        throw Object.assign(new Error('trash store is unavailable'), { code: 'trash-store-unavailable', status: 503 });
+    }
+    return trash.records.get(String(id)) ?? null;
+}
+
 async function isVisibleArchivedSession(registry, pendingStore, trashStore, id, scope = 'archive') {
     const key = String(id);
     if (!registry.archivedSessionIds.map(String).includes(key)) return false;
@@ -746,7 +767,14 @@ async function deleteSession(ctx, registry, persistence, id, titleCache, statsSe
             const location = await persistence.locate(header);
             if (typeof location?.path !== 'string') throw Object.assign(new Error('session location unavailable'), { code: 'session-location-unavailable' });
             const sessionDirectory = dirname(location.path);
-            await rm(sessionDirectory, { recursive: true, force: true });
+            // The only recursive delete in this plugin. Confirm the directory is
+            // the session's own before removing it, the same invariant the two
+            // restore paths apply: on a host layout that keeps logs as flat
+            // files this would otherwise remove the whole session root.
+            if (basename(sessionDirectory) !== String(id)) {
+                throw Object.assign(new Error('session location is not session-scoped'), { code: 'session-location-unsafe' });
+            }
+            await rm(sessionDirectory, { recursive: true, force: true, ...RM_RETRY });
             try {
                 await lstat(sessionDirectory);
                 throw Object.assign(new Error('session directory still exists'), { code: 'session-delete-unconfirmed' });
@@ -777,31 +805,6 @@ async function deleteSession(ctx, registry, persistence, id, titleCache, statsSe
     return lockHeld ? commit() : lifecycle.run(commit);
 }
 
-/**
- * Boot-time sweep: every pending-deletion id is cold now (plugin activation
- * precedes any client resume), so each one completes the ordinary delete
- * path. Ids that fail stay in the store for the next boot.
- */
-async function sweepPendingDeletions(ctx, registry, persistence, statsService, metadataStore, pendingStore, lifecycle) {
-    let pending;
-    try {
-        pending = await pendingStore.load();
-    } catch (error) {
-        ctx.logger.warn(`archived-chats: pending-deletions store unreadable: ${String(error)}`);
-        return;
-    }
-    if (pending.size === 0) return;
-    for (const id of [...pending]) {
-        try {
-            const outcome = await deleteSession(ctx, registry, persistence, id, undefined, statsService, metadataStore, pendingStore, lifecycle, true);
-            if (outcome === 'deleted') ctx.logger.info?.(`archived-chats: swept pending deletion ${id}`);
-            else if (outcome === 'cancelled') ctx.logger.info?.(`archived-chats: cancelled pending deletion ${id}`);
-        } catch (error) {
-            ctx.logger.warn(`archived-chats: pending deletion ${id} failed again: ${String(error)}`);
-        }
-    }
-}
-
 //#endregion
 
 //#region routes
@@ -868,7 +871,18 @@ function registerRoutes(ctx, webServer, registry, persistence, titleCache, metad
                 throw Object.assign(new Error('live session remains parked'), { code: 'session-live-purge-pending' });
             }
             const outcome = await deleteSession(ctx, registry, persistence, id, titleCache, statsService, metadataStore, pendingStore, lifecycle, false, true, false);
-            if (outcome !== 'deleted') throw Object.assign(new Error('physical purge was cancelled'), { code: 'purge-cancelled' });
+            if (outcome === 'deleted') return;
+            // `cancelled` only means the delete found nothing left to do. When the
+            // session is genuinely gone from both persistence and the archive,
+            // this is a retry of a purge whose files were already removed and it
+            // must complete — otherwise the record strands in purge-pending with
+            // no session left to restore.
+            const archived = registry.archivedSessionIds.map(String).includes(String(id));
+            let present = true;
+            try { present = (await persistence.list()).some((header) => String(header.id) === String(id)); }
+            catch { present = true; }
+            if (archived || present) throw Object.assign(new Error('physical purge was cancelled'), { code: 'purge-cancelled' });
+            await pendingStore.remove([id]);
         },
         invalidate: invalidateRecycleCaches,
         logger: ctx.logger,
@@ -1354,7 +1368,7 @@ function registerRoutes(ctx, webServer, registry, persistence, titleCache, metad
                 }
                 if (aborted) return;
             } catch (error) {
-                if (res.headersSent || res.status === 200) {
+                if (res.headersSent) {
                     ctx.logger.warn(`archived-chats: export stream failed: ${String(error?.code ?? error?.name ?? 'Error')}`);
                     res.destroy?.();
                     return;
@@ -1478,7 +1492,7 @@ function registerRoutes(ctx, webServer, registry, persistence, titleCache, metad
                     send(res, 404, { error: 'session-not-archived' });
                     return;
                 }
-                if ((await trashStore.get(body.sessionId)) !== null) {
+                if ((await requireTrashRecord(trashStore, body.sessionId)) !== null) {
                     send(res, 409, { error: 'session-in-trash' });
                     return;
                 }
@@ -1547,12 +1561,12 @@ function registerRoutes(ctx, webServer, registry, persistence, titleCache, metad
                     send(res, 400, { error: 'sessionId-required' });
                     return;
                 }
-                if ((await trashStore.get(body.sessionId)) !== null) {
+                if ((await requireTrashRecord(trashStore, body.sessionId)) !== null) {
                     send(res, 409, { error: 'session-in-trash' });
                     return;
                 }
                 const archivedSessionIds = await lifecycle.run(async () => {
-                    if ((await trashStore.get(body.sessionId)) !== null) throw Object.assign(new Error('session is in trash'), { code: 'session-in-trash', status: 409 });
+                    if ((await requireTrashRecord(trashStore, body.sessionId)) !== null) throw Object.assign(new Error('session is in trash'), { code: 'session-in-trash', status: 409 });
                     const next = await unarchiveIds(registry, [body.sessionId]);
                     titleCache.delete(body.sessionId);
                     projectedMessages.invalidate([body.sessionId]);
@@ -1561,7 +1575,7 @@ function registerRoutes(ctx, webServer, registry, persistence, titleCache, metad
                 });
                 send(res, 200, { ok: true, archivedSessionIds });
             } catch (error) {
-                send(res, error.status ?? 500, { error: 'unarchive-failed', message: String(error?.message ?? error) });
+                send(res, error.status ?? 500, { error: error.code ?? 'unarchive-failed', message: String(error?.message ?? error) });
             }
         },
     }), 'archived-chats: unarchive route');

package/lib/recycle.js

@@ -85,8 +85,6 @@ export function createRecycleService({
   if (typeof persistence?.list !== 'function') throw new TypeError('persistence.list is required');
   if (typeof trashStore?.load !== 'function' || typeof snapshotStore?.capture !== 'function') throw new TypeError('recycle stores are required');
   if (typeof lifecycle?.run !== 'function') throw new TypeError('lifecycle.run is required');
-  void attachments;
-  void purgePhysical;
 
   async function loadedTrash() {
     const loaded = await trashStore.load();
@@ -313,7 +311,7 @@ export function createRecycleService({
     if (typeof persistence.create !== 'function' || typeof persistence.append !== 'function' || typeof persistence.locate !== 'function') {
       throw error('snapshot-restore-unsupported', 'persistence restore capability is unavailable', 501);
     }
-    const location = persistence.locate(meta);
+    const location = await persistence.locate(meta);
     if (typeof location?.path !== 'string' || basename(dirname(location.path)) !== id) {
       throw error('snapshot-restore-unsupported', 'persistence rollback location is unavailable', 501);
     }
@@ -408,7 +406,7 @@ export function createRecycleService({
       if (createAttempted) {
         try {
           if (typeof persistence.removeSession === 'function') await persistence.removeSession(id);
-          else await rm(dirname(location.path), { recursive: true, force: true });
+          else await rm(dirname(location.path), { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
         } catch (rollbackError) { rollbackErrors.push(rollbackError); }
       }
       if (rollbackErrors.length > 0) {
@@ -463,15 +461,20 @@ export function createRecycleService({
         if (!['trashed', 'degraded'].includes(record.state)) throw error('trash-state-conflict', 'trash record cannot be purged', 409);
         record = await trashStore.transition(id, 'purge-pending', { purgeRequestedAt: now().toISOString() });
       }
+      // Order matters. Capabilities are checked first, then the snapshots are
+      // removed, and only then the session log — the irreversible step. Anything
+      // that fails before `purgePhysical` leaves the original session intact, so
+      // the record stays completable on the next attempt instead of stranding in
+      // purge-pending with its session already gone.
       if (typeof purgePhysical !== 'function') throw error('purge-unsupported', 'physical purge is unavailable', 501);
-      await purgePhysical(id, record);
       if (typeof snapshotStore.removeForSession !== 'function' || typeof snapshotStore.latestFor !== 'function') {
         throw error('purge-unsupported', 'snapshot purge verification is unavailable', 501);
       }
-      await snapshotStore.removeForSession(id);
+      await snapshotStore.removeForSession(id, { knownIds: [record.snapshotId] });
       if (await snapshotStore.latestFor(id) !== null) {
         throw error('snapshot-delete-unconfirmed', 'session snapshots still exist');
       }
+      await purgePhysical(id, record);
       const removed = await trashStore.remove(id);
       if (!removed.includes(id)) throw error('trash-state-conflict', 'trash record changed during purge', 409);
       invalidate?.([id]);

package/lib/restore.js

@@ -1,5 +1,8 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
+
+/** Events appended per call, matching the History restore writer. */
+const APPEND_BATCH = 500;
 
 function unsupported(reason = 'writer-missing') {
   const error = new Error('restore is unsupported by this Harness host');
@@ -8,13 +11,47 @@ function unsupported(reason = 'writer-missing') {
   return error;
 }
 
+/**
+ * Resolve a session writer. A host that exposes a dedicated restore entry point
+ * is preferred; otherwise the ordinary create/append/locate surface is used —
+ * the same capability History "restore as copy" and recycle snapshot restore
+ * already write through, so ZIP import works wherever those work instead of
+ * reporting `restore-unsupported` on the very same host.
+ */
 function resolveWriter(persistence) {
-  if (typeof persistence?.restoreSession === 'function') return persistence.restoreSession.bind(persistence);
-  if (typeof persistence?.restore === 'function') return persistence.restore.bind(persistence);
-  if (typeof persistence?.importSession === 'function') return persistence.importSession.bind(persistence);
+  if (typeof persistence?.restoreSession === 'function') return { kind: 'native', write: persistence.restoreSession.bind(persistence) };
+  if (typeof persistence?.restore === 'function') return { kind: 'native', write: persistence.restore.bind(persistence) };
+  if (typeof persistence?.importSession === 'function') return { kind: 'native', write: persistence.importSession.bind(persistence) };
+  if (typeof persistence?.create === 'function'
+    && typeof persistence?.append === 'function'
+    && typeof persistence?.locate === 'function') {
+    return { kind: 'append', write: (payload) => appendWrite(persistence, payload) };
+  }
   return null;
 }
 
+/**
+ * Write one session through create + append and return an undo that removes it.
+ * The destination is confirmed to be session-scoped before anything is created,
+ * so the fallback rollback can never delete more than this session.
+ */
+async function appendWrite(persistence, payload) {
+  const meta = structuredClone(payload.meta);
+  const location = await persistence.locate(meta);
+  if (typeof location?.path !== 'string' || basename(dirname(location.path)) !== String(payload.id)) {
+    throw unsupported('rollback-location-missing');
+  }
+  await persistence.create(meta);
+  const events = payload.events;
+  for (let offset = 0; offset < events.length; offset += APPEND_BATCH) {
+    await persistence.append(payload.id, structuredClone(events.slice(offset, offset + APPEND_BATCH)));
+  }
+  return async () => {
+    if (typeof persistence.removeSession === 'function') { await persistence.removeSession(payload.id); return; }
+    await rm(dirname(location.path), { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  };
+}
+
 function resolveRemove(persistence) {
   const remove = persistence?.removeSession ?? persistence?.deleteSession ?? persistence?.remove;
   return typeof remove === 'function' ? remove.bind(persistence) : null;
@@ -51,7 +88,9 @@ export function createRestoreAdapter({ ctx, persistence, registry, metadataStore
   const remover = resolveRemove(persistence);
   let capability = { supported: true };
   if (writer === null) capability = { supported: false, reason: 'writer-missing' };
-  else if (remover === null) capability = { supported: false, reason: 'rollback-missing' };
+  // The append writer carries its own session-scoped rollback, so a dedicated
+  // remover is only required for the native restore entry points.
+  else if (remover === null && writer.kind !== 'append') capability = { supported: false, reason: 'rollback-missing' };
   else if (typeof registry?.setState !== 'function' || registry.state === undefined) capability = { supported: false, reason: 'registry-writer-missing' };
   else if (typeof metadataStore?.getMany !== 'function' || typeof metadataStore?.set !== 'function' || typeof metadataStore?.remove !== 'function') capability = { supported: false, reason: 'metadata-writer-missing' };
 
@@ -92,8 +131,10 @@ export function createRestoreAdapter({ ctx, persistence, registry, metadataStore
           await writeFile(path, `${JSON.stringify(item.record)}\n`, { encoding: 'utf8', mode: 0o600 });
           if (typeof persistence.inspect === 'function') {
             // The host inspection is a capability check only; it does not replace
-            // the staged record or mutate any existing session.
-            await Promise.resolve(persistence.inspect(item.id, { staged: item.record }));
+            // the staged record or mutate any existing session. The id does not
+            // exist yet, so a reader that fails closed on unknown sessions is the
+            // expected answer and must not abort the restore.
+            await Promise.resolve(persistence.inspect(item.id, { staged: item.record })).catch(() => undefined);
           }
           staged.push(item);
         } catch (error) {
@@ -141,9 +182,9 @@ export function createRestoreAdapter({ ctx, persistence, registry, metadataStore
               events: item.record.source.events,
               archive: item.record.archive,
             };
-            const fallbackUndo = () => remover(item.id);
+            const fallbackUndo = remover === null ? () => undefined : () => remover(item.id);
             transaction._undos.push(fallbackUndo);
-            const result = await writer(payload);
+            const result = await writer.write(payload);
             transaction._undos[transaction._undos.length - 1] = resolveUndo(result, fallbackUndo);
             const workspace = workspaceFor(registry, item.workspace?.id);
             if (workspace === null) {

package/lib/search.js

@@ -398,11 +398,34 @@ function searchSessionLimit(value) {
   return value;
 }
 
+/**
+ * Map one offset in the normalized text back to its source code-point index.
+ * Only needed when NFKC changed the text length (fi → fi, ⑴ → (1), ㎡ → m2):
+ * a length-preserving mapping keeps offsets aligned already.
+ */
+function sourcePointOffset(points, offset) {
+  let consumed = 0;
+  for (let index = 0; index < points.length; index += 1) {
+    const next = consumed + normalizeSearchText(points[index]).length;
+    if (offset < next) return index;
+    consumed = next;
+  }
+  return points.length;
+}
+
 function excerptFor(message, terms) {
   const points = codePoints(message.searchable.replace(/\s+/gu, ' ').trim());
-  const normalized = normalizeSearchText(points.join(''));
-  const firstUtf16 = terms.map((term) => normalized.indexOf(term)).filter((index) => index >= 0).sort((a, b) => a - b)[0] ?? 0;
-  const first = codePoints(normalized.slice(0, firstUtf16)).length;
+  const text = points.join('');
+  const normalized = normalizeSearchText(text);
+  const matched = terms.map((term) => normalized.indexOf(term)).filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  // A normalized offset is a valid source offset only while normalization
+  // preserved length; otherwise the window has to be mapped back explicitly or
+  // the excerpt lands somewhere that does not contain the match at all.
+  const first = matched === undefined
+    ? 0
+    : (normalized.length === text.length
+      ? codePoints(text.slice(0, matched)).length
+      : sourcePointOffset(points, matched));
   const radius = Math.floor(SEARCH_LIMITS.excerptCodePoints / 2);
   const start = Math.max(0, first - radius);
   const end = Math.min(points.length, start + SEARCH_LIMITS.excerptCodePoints);

package/lib/snapshot.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { relative, resolve } from 'node:path';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { findProjectedImage, paginateProjectedMessages, projectArchivedMessages } from './search.js';
 import { syncDirectory } from './durable.js';
 
@@ -16,6 +16,13 @@ export const SNAPSHOT_LIMITS = Object.freeze({
 
 export const HISTORY_SNAPSHOT_LIMIT = 5000;
 
+/**
+ * Windows keeps a deleted directory entry alive while any handle is open (an
+ * indexer or antivirus scan is enough), surfacing as EBUSY/EPERM/ENOTEMPTY.
+ * Retrying is the documented remedy and is harmless elsewhere.
+ */
+const RM_RETRY = Object.freeze({ maxRetries: 5, retryDelay: 50 });
+
 const SNAPSHOT_FORMAT = 'dsh-archived-chats/snapshot';
 const SESSION_FORMAT = 'dsh-archived-chats/snapshot-session';
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -144,9 +151,15 @@ function mediaExtension(mediaType) {
   return subtype || 'bin';
 }
 
+/**
+ * Containment test that holds on both separators. `relative()` answers with the
+ * platform separator, so a POSIX-only `'../'` check misses `'..\\'` on Windows;
+ * an absolute answer means a different drive or root entirely.
+ */
 function isWithin(root, candidate) {
   const path = relative(root, candidate);
-  return path === '' || (!path.startsWith('..') && !path.includes('../'));
+  if (path === '') return true;
+  return !isAbsolute(path) && path !== '..' && !path.startsWith(`..${sep}`);
 }
 
 function validSnapshotId(snapshotId) {
@@ -397,7 +410,7 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
         if (error?.code !== 'ENOENT') throw error;
       }
       for (let attempt = 0; attempt < SNAPSHOT_LIMITS.maxRevisionAttempts; attempt += 1) {
-        await rm(staging, { recursive: true, force: true });
+        await rm(staging, { recursive: true, force: true, ...RM_RETRY });
         const before = await sourceRevision(sessionId);
         let inspected;
         try { inspected = await persistence.inspect(sessionId); }
@@ -468,7 +481,14 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
         await syncDirectory(staging);
         try { await rename(staging, destination); }
         catch (error) {
-          if (error?.code === 'EEXIST' || error?.code === 'ENOTEMPTY') throw failure('snapshot-conflict', 'snapshot id already exists', 409);
+          // Windows reports a rename onto an existing directory as EPERM/EACCES
+          // rather than EEXIST/ENOTEMPTY, so confirm what is actually there.
+          if (['EEXIST', 'ENOTEMPTY', 'EPERM', 'EACCES'].includes(error?.code)) {
+            let occupied = false;
+            try { occupied = (await lstat(destination)) !== undefined; }
+            catch (probe) { if (probe?.code !== 'ENOENT') throw error; }
+            if (occupied) throw failure('snapshot-conflict', 'snapshot id already exists', 409);
+          }
           throw error;
         }
         await syncDirectory(canonicalRoot);
@@ -476,7 +496,7 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
       }
       throw failure('snapshot-source-busy', 'snapshot source did not stabilize', 409);
     } finally {
-      await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+      await rm(staging, { recursive: true, force: true, ...RM_RETRY }).catch(() => undefined);
     }
   }
 
@@ -684,7 +704,7 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
         const path = resolve(staging, entry);
         try {
           const details = await lstat(path);
-          if (details.mtimeMs < storeStartedAt) await rm(path, { recursive: true, force: true });
+          if (details.mtimeMs < storeStartedAt) await rm(path, { recursive: true, force: true, ...RM_RETRY });
         } catch (error) {
           if (error?.code !== 'ENOENT') throw error;
         }
@@ -720,7 +740,7 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
   async function remove(snapshotId) {
     const canonicalRoot = await ensureRoot();
     const directory = await snapshotPath(snapshotId, canonicalRoot);
-    await rm(directory, { recursive: true, force: true });
+    await rm(directory, { recursive: true, force: true, ...RM_RETRY });
     try {
       await lstat(directory);
       throw failure('snapshot-delete-unconfirmed', 'snapshot directory still exists');
@@ -730,13 +750,39 @@ export function createSnapshotStore({ root, persistence, attachments, now = () =
     await syncDirectory(canonicalRoot);
   }
 
-  async function removeForSession(sessionId) {
+  /**
+   * Read one published snapshot's owning session id without validating its
+   * contents, so a degraded snapshot can still be attributed to the session it
+   * belongs to. Returns null when even the manifest identity is unreadable.
+   */
+  async function snapshotOwner(snapshotId, canonicalRoot) {
+    try {
+      const directory = await snapshotPath(snapshotId, canonicalRoot);
+      const bytes = await readBounded(resolve(directory, 'manifest.json'), SNAPSHOT_LIMITS.maxManifestBytes);
+      const value = parseJson(bytes, 'manifest.json');
+      return plainObject(value) && typeof value.sessionId === 'string' && value.sessionId !== '' ? value.sessionId : null;
+    } catch { return null; }
+  }
+
+  /**
+   * Remove every published snapshot belonging to one session. A snapshot that
+   * fails validation is still removed when its manifest identity attributes it
+   * to this session, and an unrelated degraded snapshot is skipped instead of
+   * aborting the sweep — physical purge must never be blocked by corruption
+   * somewhere else in the store. `knownIds` covers records whose snapshot is
+   * damaged past attribution.
+   */
+  async function removeForSession(sessionId, { knownIds = [] } = {}) {
     if (typeof sessionId !== 'string' || sessionId === '') return [];
     const canonicalRoot = await ensureRoot();
     const removed = [];
+    const claimed = new Set((Array.isArray(knownIds) ? knownIds : [knownIds])
+      .filter((id) => typeof id === 'string' && UUID.test(id)));
     for (const entry of await publishedEntries(canonicalRoot)) {
-      const checked = await validate(entry.name);
-      if (checked.manifest.sessionId !== sessionId) continue;
+      let owner;
+      try { owner = (await validate(entry.name)).manifest.sessionId; }
+      catch { owner = await snapshotOwner(entry.name, canonicalRoot); }
+      if (owner !== sessionId && !claimed.has(entry.name)) continue;
       await remove(entry.name);
       removed.push(entry.name);
     }

package/lib/stats.js

@@ -1,9 +1,12 @@
 import { lstat, readdir, realpath } from 'node:fs/promises';
-import { dirname, join, relative, sep } from 'node:path';
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 
+// An absolute answer from relative() means a different drive or root, which
+// Windows can produce and a separator check alone would accept.
 const isWithin = (root, path) => {
   const pathFromRoot = relative(root, path);
-  return pathFromRoot === '' || (!pathFromRoot.startsWith(`..${sep}`) && pathFromRoot !== '..' && !pathFromRoot.startsWith(sep));
+  return pathFromRoot === ''
+    || (!isAbsolute(pathFromRoot) && pathFromRoot !== '..' && !pathFromRoot.startsWith(`..${sep}`));
 };
 
 export async function measureDirectory(root) {

package/lib/types/index.d.ts

@@ -16,10 +16,16 @@
  * attachment descriptors, and
  * degrades only image loading when the optional attachment service is absent.
  * Metadata mutation remains guarded through `/metadata`, and archive restore is
- * preview-first through the import routes. Import restore is capability detected
- * and returns `restore-unsupported` when the host has no writer. Ordinary
- * delete creates a verified local protection snapshot and moves the session
- * into the recycle catalog; only guarded trash purge physically deletes it.
+ * preview-first through the import routes. Import restore is capability
+ * detected: a dedicated host restore entry point is preferred, otherwise the
+ * ordinary create/append/locate surface is used, and `restore-unsupported` is
+ * returned only when neither exists. Archive mutations fail closed while the
+ * recycle catalog is unreadable, and `/state` reports `trashStatus` so the
+ * listing can be labelled as unverified. Ordinary delete creates a verified
+ * local protection snapshot and moves the session into the recycle catalog;
+ * only guarded trash purge physically deletes it, removing protection
+ * snapshots before the irreversible session delete so a failure never strands
+ * a record whose session is already gone.
  * Startup migrates legacy pending deletions into recoverable trash and retries
  * only records carrying durable `purge-pending` intent.
  */
@@ -62,6 +68,7 @@ export interface HistoryRestoreResult {
   warnings: Array<{ id: string; reason: string }>;
 }
 
+/** A degraded version carries no readable bytes but can still be reclaimed. */
 export interface HistoryDeleteResult {
   deleted: string[];
   freedBytes: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-archived-chats",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "DeepSeek Harness 会话档案：按工作区浏览和全文搜索归档聊天，原生只读预览对话、工具活动和已存储图片，管理标签备注与 ZIP 备份恢复；保留历史版本并恢复为副本，提供可撤销回收站、空间分账、保留策略和来源与分支。所有数据留在本机。 Session Archive for DeepSeek Harness: browse and full-text search archived chats; natively preview conversations, tool activity, and stored images read-only; manage tags, notes, and ZIP backup restore; retain local History with restore-as-copy, an undoable Recycle Bin, storage accounting, retention policies, and Origins & Branches. All data stays local.",
   "license": "MIT",
   "author": "Ultronen",