dsh-conversation-recycle-bin 0.3.11 → 0.3.13

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.5`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.13`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -97,14 +97,14 @@ memory  →  messages  →  session/catalog
 1. `POST /preview`：校验 session 存在、工作区归属、是否受保护/子代理/超出允许根；hard 模式下活跃会话不再拒绝，而是给出「会先停止该会话」的 warning（`stopLiveSessions:false` 时仍拒绝）。随后统计日志条数与记忆数，签发**单次使用**确认 token（绑定排序后的 sessionIds + includeMemory + mode，TTL 默认 120s）。
 2. `POST /delete`：
    - 传输层依次过三道闸：本路由自身的 loopback/Origin（比较完整 authority：主机名**和**有效端口，桌面 `dsh-app://app` 外壳源按 DSH 自己的口径豁免）/私有 header 校验 → DSH `connection.requestRejection`（401/403 短路）→ `ctx.waterfall('connection/request', ...)`（桌面更新任务借此在安装更新时返回 503 并排空在途请求，删除事务不会被杀在半路）；
-   - token（彻底删除无需短语；批量软删除校验数量）、**有效批量上限** `min(maxBatchSessions, 本分钟剩余额度)`、限流（默认 20 次/分钟，滑动窗口）全部通过后才消费 token；
+   - token（彻底删除无需短语；批量软删除校验数量）、**有效批量上限** `min(maxBatchSessions, 本分钟剩余额度)`、限流（默认 20 次/分钟，滑动窗口）全部通过后才执行；token 只在**整批零失败**时作废，部分或全部失败都保留（重放只能重跑同一计划），避免用户为同一批失败项重新预览；
    - 先对**全部**会话做策略预检，任一被拒绝则整批不执行（不会半成功）；
    - 逐会话执行 `quiesce(live) → memory → messages → session/catalog` 事务；
    - 所有 mutation（delete/restore/purge/discard）串行经过进程内链 + `<dataDir>/mutation.lock` 跨进程文件锁：桌面端与 `dsh web` 共享一个 `DSH_HOME` 时，第二个实例的并发删除会拿到 `E_LOCK_BUSY` 而不是写坏同一份 manifest；
    - 队列与锁都有预算，不会无限等待：排队超过 `lockTimeoutMs + 60s` 抛 `E_QUEUE_TIMEOUT`（503，**未执行任何动作**，可安全重试）；客户端在排队或取锁期间断开（关标签页/刷新）抛 `E_ABANDONED`（409，同样未执行）。两者都表示"什么都没发生"，与 `E_TRANSACTION_FAILED`（可能已部分执行）区分开；
    - 锁文件 stale 判定：pid 可证明已死才立即破锁；无 owner 的锁只按 age 破；**持有者活着时绝不按 age 破**（否则长 GC 会放进第二个写者）。连续 3 次删不掉 stale 锁即 `E_LOCK_BUSY`，不空转；
    - 返回 `{ok: true, partial, results, failures}`：`ok` 表示计划已执行，`partial` 表示有会话失败；只有**全部**失败时才抛首个错误（HTTP 状态来自 `ERROR_STATUS`，错误码保留真实策略码）。
-3. `GET /trash`（返回 `entries`（可恢复）与 `incomplete`（failed/pending/restoring/purging））、`POST /trash/restore`、`POST /trash/purge`（必须输入 `DELETE`）、`POST /trash/discard`（清理未完成条目，必须输入 `DELETE`；仍保存会话日志的条目应走「恢复」而不是 discard）。未完成条目若还留着会话日志，设置页会给出「恢复」按钮，可以直接把它恢复回会话列表。
+3. `GET /trash`（返回 `entries`（可恢复）与 `incomplete`（failed/pending/restoring/purging）；每行带 `capabilities`，其 `canRestore`/`canDiscard` 同时看 manifest 与磁盘载荷）、`POST /trash/restore`、`POST /trash/purge`（必须输入 `DELETE`）、`POST /trash/discard`（清理未完成条目，必须输入 `DELETE`；仍保存会话日志或记忆文件的条目应走「恢复」而不是 discard）。未完成条目若还留着会话日志或记忆包，设置页会按 `capabilities.canRestore` 给出「恢复」按钮，可以直接把它恢复回会话列表；hard 删除在「日志已移入回收站、manifest 尚未记录」的崩溃窗口里，restore 会从日志头部的 `cwd` 重建原路径并把日志移回，不再出现三路全拒的死条目。
 4. `GET /audit?limit=N`。
 
 ### 4.2 安全清单
@@ -149,7 +149,7 @@ memory  →  messages  →  session/catalog
       files/<nodeId>.content
 ```
 
-**保留期（自动清理）**：`trashRetentionDays`（默认 **30**）现在真的生效 —— Host 每 6 小时清扫一次（启动后 60 秒先扫一次），并且**每次打开回收站列表时在后台触发一次**（5 分钟内不重复；列表本身不等清扫，所以锁被占用也不会出现空白页）。只有 `status: 'trashed'` 且 `deletedAt` 可解析、且早于 `now - trashRetentionDays` 的条目会被清走，走的是与「永久清除」**完全相同**的 `performPurge` 路径（重新读 manifest、复判 `capabilities.canPurge`、写审计 `action: 'purge'` + `source: 'retention'`），单次最多 20 条、最旧优先，失败按指数退避重试（5 分钟起，上限 6 小时）。`pending`/`restoring`/`restored`/`purging` 与"从未提交"的残留条目**永不自动清**（那是 bug 现场，留给设置页的「恢复」/「discard」出口）；`mode: 'soft'` 且会话又能被解析的条目也会跳过（无人值守时不去碰"复活"的对话）。`trashRetentionDays: 0` 或 `enabled: false` 都会关闭清扫（后者连定时器都不注册，读接口仍然可用），条目一直留到你自己删。回收站列表里会写明"删除 N 天后自动清理"，每条显示 Host 下发的剩余天数，后台刚清过东西时还会提示清了几条。
+**保留期（自动清理）**：`trashRetentionDays`（默认 **30**）现在真的生效 —— Host 每 6 小时清扫一次（启动后 60 秒先扫一次），并且**每次打开回收站列表时在后台触发一次**（5 分钟内不重复；列表本身不等清扫，所以锁被占用也不会出现空白页）。只有 `status: 'trashed'` 且 `deletedAt` 可解析、且早于 `now - trashRetentionDays` 的条目会被清走，走的是与「永久清除」**完全相同**的 `performPurge` 路径（重新读 manifest、复判 `capabilities.canPurge`、写审计 `action: 'purge'` + `source: 'retention'`），单次最多 20 条、最旧优先，失败按指数退避重试（5 分钟起，上限 6 小时）。`pending`/`restoring`/`restored`/`purging` 与"从未提交"的残留条目**永不自动清**（那是 bug 现场，留给设置页的「恢复」/「discard」出口）；`mode: 'soft'` 且会话已被用户复活（未归档）或仍在运行的条目会跳过（无人值守时不去碰正在使用的对话），而仍处于归档状态的 soft 条目会照常清理——soft 删除本身保留日志，不再因为"日志还在"而永久逃过保留期。`trashRetentionDays: 0` 或 `enabled: false` 都会关闭清扫（后者连定时器都不注册，读接口仍然可用），条目一直留到你自己删。回收站列表里会写明"删除 N 天后自动清理"，每条显示 Host 下发的剩余天数，后台刚清过东西时还会提示清了几条。
 
 `manifest.status` 只允许 `pending → trashed → restoring/restored / purging`。`GET /trash` 把**所有**条目都返回：`trashed` 进 `entries`（回收站 UI，可恢复/彻底删除），其余状态进 `incomplete`（设置页单独列出，提供「恢复」与「discard」两个出口，不再出现"失败了却没有任何清理入口"的死条目）。恢复顺序是删除的逆序：日志 → catalog → 记忆。
 
@@ -206,7 +206,7 @@ dsh-conversation-recycle-bin/
 │     ├─ memory.js               # 适配器装配
 │     ├─ feedback.js             # 反馈校验/渲染/投递（http 或 smtp，凭证只读环境变量）
 │     └─ api.js                 # 同源 HTTP API、确认 token、限流
-└─ test/                        # 138 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
+└─ test/                        # 186 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
 ```
 
 ---
@@ -215,7 +215,7 @@ dsh-conversation-recycle-bin/
 
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
-npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（138 个用例）
+npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（186 个用例）
 npm run check   # 语法 + manifest
 ```
 
@@ -303,8 +303,8 @@ node -e "console.log('b64:' + Buffer.from('your-feedback@example.com','utf8').to
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
 npm run check                      # 语法 + manifest（含 feedback.js）
-node test/feedback.test.mjs        # 19 个反馈用例
-npm test                           # 全量 138 个用例
+node test/feedback.test.mjs        # 20 个反馈用例
+npm test                           # 全量 186 个用例
 
 # 端到端：用本机收件桩观察真实投递路径，不外发邮件
 $env:DSH_CRB_MAIL_API_URL   = 'http://127.0.0.1:9099/emails'

package/client.js

@@ -216,6 +216,8 @@ window.__ModuleLoader__.load({
         'error.E_FORBIDDEN_ORIGIN': 'The Host rejected this page as an untrusted origin.',
         'error.E_POLICY_FOREIGN_WRITER': 'Another DSH instance is still writing this conversation; close it there and retry.',
         'error.E_LOCK_BUSY': 'Another DSH instance is using this recycle bin; retry in a moment.',
+        'error.E_QUEUE_TIMEOUT': 'The Host was still busy with another change, so this request was not applied. Retry in a moment.',
+        'error.E_ABANDONED': 'The page gave up waiting before the Host started; nothing was changed. Retry.',
         'error.E_UNAUTHORIZED': 'This request is not authenticated with the Host.',
         'adapter.lingshu': 'Lingshu cognitive graph (md_cg)',
         'adapter.generic-json': 'Generic JSON memory store',
@@ -376,6 +378,8 @@ window.__ModuleLoader__.load({
         'error.E_FORBIDDEN_ORIGIN': '宿主拒绝了该页面的请求（来源校验未通过）。',
         'error.E_POLICY_FOREIGN_WRITER': '另一个 DSH 实例仍在写这个对话，已中止删除；请先关闭那边的对话再重试。',
         'error.E_LOCK_BUSY': '另一个 DSH 实例正在使用回收站，请稍后重试。',
+        'error.E_QUEUE_TIMEOUT': '宿主还在处理另一个变更，这次请求没有执行，请稍后重试。',
+        'error.E_ABANDONED': '页面在宿主开始处理前就放弃了等待，本次没有做任何改动，请重试。',
         'error.E_UNAUTHORIZED': '该请求未通过宿主的鉴权。',
         'adapter.lingshu': '灵枢认知图 (md_cg)',
         'adapter.generic-json': '通用 JSON 记忆存储',
@@ -1109,9 +1113,15 @@ window.__ModuleLoader__.load({
           // memory locks, per-item moves) replaces the client's flat guess:
           // aborting while the Host keeps deleting left a consumed token and a
           // half-changed list behind.
-          const planTimeout = Number.isFinite(preview?.limits?.planTimeoutMs)
-            ? Math.max(1_000, preview.limits.planTimeoutMs)
-            : mutationTimeoutMs(sessionIds.length)
+          // The Host publishes the budget it actually enforces: the lock wait
+          // plus the queue grace period. The lock-only estimate used to abort
+          // 60 s before the Host gave up, so a busy bin looked like a failure
+          // while the deletion was still running.
+          const planTimeout = Number.isFinite(preview?.limits?.queueTimeoutMs)
+            ? Math.max(1_000, preview.limits.queueTimeoutMs)
+            : Number.isFinite(preview?.limits?.planTimeoutMs)
+              ? Math.max(1_000, preview.limits.planTimeoutMs)
+              : mutationTimeoutMs(sessionIds.length)
           const result = await api('/delete', {
             method: 'POST',
             timeoutMs: planTimeout,
@@ -1549,39 +1559,55 @@ window.__ModuleLoader__.load({
       return h('div', { className: 'dc-panel dc-incomplete' },
         h('div', { className: 'dc-state-title' }, `${t('trash.incompleteTitle')} (${entries.length})`),
         h('p', { className: 'dc-hint' }, t('trash.incompleteHint')),
-        ...entries.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
-          h('div', { className: 'dc-row-main' },
-            h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId || entry.trashId),
-            h('div', { className: 'dc-hint' }, entry.status === 'unreadable' && entry.error?.message
-              ? `${t('trash.status.unreadable')} · ${entry.error.message}`
-              : `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
-          h('div', { className: 'dc-row-actions' },
-            entry.hasSessionLog === true && typeof onRestore === 'function'
-              ? h(Button, {
-                onClick: () => onRestore(entry.trashId),
-                disabled: restoreBusyId === entry.trashId,
-                title: t('trash.restoreIncompleteHint'),
-              }, t('action.restore'))
-              : null,
-            discardTarget === entry.trashId
-              ? h('span', { className: 'dc-inline-confirm' },
-                h('input', {
-                  type: 'text',
-                  value: discardPhrase,
-                  placeholder: 'DELETE',
-                  className: 'dc-input dc-input-small',
-                  onChange: (event) => onPhrase(event.target.value),
-                }),
-                h(Button, {
-                  variant: 'danger',
-                  disabled: discardBusyId === entry.trashId || discardPhrase.trim() !== 'DELETE',
-                  onClick: () => onDiscard(entry.trashId),
-                }, t('trash.discard')),
-                h(Button, { disabled: discardBusyId === entry.trashId, onClick: onCancel }, t('action.cancel')))
-              : h(Button, {
-                onClick: () => onStart(entry.trashId),
-                title: t('trash.confirmDiscard'),
-              }, t('trash.discard'))))))
+        ...entries.map((entry) => {
+          // The Host knows what is actually recoverable (a moved log, a memory
+          // bundle, or nothing at all). Falling back to `hasSessionLog` keeps
+          // older Hosts working, but a memory-only entry used to show Discard
+          // only — the route refuses that while memory files remain — so the
+          // one action the Host offered was its API, not the UI.
+          const canRestore = entry.capabilities === undefined
+            ? entry.hasSessionLog === true
+            : entry.capabilities?.canRestore === true
+          const canDiscard = entry.capabilities === undefined
+            ? true
+            : entry.capabilities?.canDiscard !== false
+          return h('div', { key: entry.trashId, className: 'dc-row' },
+            h('div', { className: 'dc-row-main' },
+              h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId || entry.trashId),
+              h('div', { className: 'dc-hint' }, entry.status === 'unreadable' && entry.error?.message
+                ? `${t('trash.status.unreadable')} · ${entry.error.message}`
+                : `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
+            h('div', { className: 'dc-row-actions' },
+              canRestore === true && typeof onRestore === 'function'
+                ? h(Button, {
+                  onClick: () => onRestore(entry.trashId),
+                  disabled: restoreBusyId === entry.trashId,
+                  title: t('trash.restoreIncompleteHint'),
+                }, t('action.restore'))
+                : null,
+              canDiscard !== true
+                ? null
+                : discardTarget === entry.trashId
+                  ? h('span', { className: 'dc-inline-confirm' },
+                    h('input', {
+                      type: 'text',
+                      value: discardPhrase,
+                      placeholder: 'DELETE',
+                      className: 'dc-input dc-input-small',
+                      onChange: (event) => onPhrase(event.target.value),
+                    }),
+                    h(Button, {
+                      variant: 'danger',
+                      disabled: discardBusyId === entry.trashId || discardPhrase.trim() !== 'DELETE',
+                      onClick: () => onDiscard(entry.trashId),
+                    }, t('trash.discard')),
+                    h(Button, { disabled: discardBusyId === entry.trashId, onClick: onCancel }, t('action.cancel')))
+                  : h(Button, {
+                    onClick: () => onStart(entry.trashId),
+                    title: t('trash.confirmDiscard'),
+                  }, t('trash.discard')))
+          )
+        }))
     }
 
     /**
@@ -1928,7 +1954,13 @@ window.__ModuleLoader__.load({
               h('div', { className: 'dc-hint' },
                 `${t('trash.deletedAt', { time: formatTime(entry.deletedAt) })} · ${entry.mode === 'hard' ? t('trash.modeHard') : t('trash.modeSoft')} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}${expiryHint(entry)}`)),
             h('div', { className: 'dc-row-actions' },
-              h(Button, { onClick: () => { void restore(entry.trashId) } }, t('action.restore')),
+              // The Host already knows whether this entry can be restored;
+              // the panel used to offer the button and then show the refusal.
+              h(Button, {
+                disabled: entry.capabilities?.canRestore === false,
+                title: entry.capabilities?.canRestore === false ? t('error.E_TRASH_CONFLICT') : t('action.restore'),
+                onClick: () => { void restore(entry.trashId) },
+              }, t('action.restore')),
               purgeTarget === entry.trashId
                 ? h('span', { className: 'dc-inline-confirm' },
                   h('input', {
@@ -1941,7 +1973,12 @@ window.__ModuleLoader__.load({
                     onClick: () => { void purge(entry.trashId, purgePhrase.trim()) },
                   }, t('action.purge')),
                   h(Button, { disabled: purgeBusy === true, onClick: () => { setPurgeTarget(null); setPurgePhrase('') } }, t('action.cancel')))
-                : h(Button, { variant: 'danger', onClick: () => { setPurgeTarget(entry.trashId); setPurgePhrase('') } }, t('action.purge')))))) : null,
+                : h(Button, {
+                  variant: 'danger',
+                  disabled: entry.capabilities?.canPurge === false,
+                  title: entry.capabilities?.canPurge === false ? t('error.E_TRASH_CONFLICT') : t('action.purge'),
+                  onClick: () => { setPurgeTarget(entry.trashId); setPurgePhrase('') },
+                }, t('action.purge')))))) : null,
 
         tab === 'trash' && incomplete.length > 0 ? h(IncompleteEntries, {
           entries: incomplete,

package/lib/core/cascade.js

@@ -154,17 +154,19 @@ export async function performSessionDelete({
     steps.push({
       name: 'messages',
       run: async () => {
-        const moved = await ops.sessionLog.moveToTrash(session, dir)
-        try {
-          // Record the move immediately. A crash between the move and the
-          // final manifest write used to leave a `pending` entry that knew
-          // nothing about the log sitting in its directory: discard refused
-          // it, restore had nothing to restore, and the payload was stranded.
-          await trash.update(entry.trashId, { sessionLog: moved })
-        } catch (error) {
-          await ops.sessionLog.restoreEntry(moved).catch(() => {})
-          throw error
-        }
+        // Persist the mapping BEFORE the rename. A crash between the move and
+        // the final manifest write used to leave a `pending` entry whose
+        // `sessionLog` was null while `session/` held the only copy: discard
+        // refused it, restore had "nothing" to restore, and the log was
+        // stranded. With the mapping recorded first, either crash side is
+        // recoverable (log still in place, or log in the bin with a known
+        // destination).
+        const moved = await ops.sessionLog.moveToTrash(session, dir, {
+          beforeMove: async (mapping) => {
+            await trash.update(entry.trashId, { sessionLog: mapping })
+            entry.sessionLog = mapping
+          },
+        })
         entry.sessionLog = moved
         return async () => {
           await ops.sessionLog.restoreEntry(moved)
@@ -178,8 +180,11 @@ export async function performSessionDelete({
   steps.push({
     name: 'session',
     run: async () => {
+      // Capture is read-only; persist it before the first catalog mutation so
+      // a crash after a detach can still restore the workspace position.
       const snapshot = await ops.catalog.capture(session)
       entry.catalog = snapshot
+      await trash.update(entry.trashId, { catalog: snapshot })
       const undo = await ops.catalog.remove(session, mode, snapshot)
       return async () => {
         await undo()
@@ -283,15 +288,26 @@ const PURGEABLE_STATUSES = new Set(['trashed', 'restored'])
  * the caller, which is the only side that can stat the entry directory.
  *
  * @param {{ status?: unknown }} entry
- * @param {{ hasLogFiles?: boolean|null, hasMemoryFiles?: boolean|null }} [disk]
+ * @param {{ hasLogFiles?: boolean|null, hasMemoryFiles?: boolean|null, requirePayload?: boolean }} [disk]
+ *   `requirePayload` makes `canRestore` false for entry states that have no
+ *   payload at all (nothing in the manifest and nothing on disk), which is the
+ *   answer the list endpoint publishes to the Client.
  */
 export function entryCapabilities(entry, disk = {}) {
   const status = typeof entry?.status === 'string' && entry.status !== '' ? entry.status : 'unknown'
   const hasLogFiles = disk.hasLogFiles ?? null
   const hasMemoryFiles = disk.hasMemoryFiles ?? null
+  const hasSessionLog = entry?.sessionLog !== null && entry?.sessionLog !== undefined
+  const hasCatalog = entry?.catalog !== null && entry?.catalog !== undefined
+  const memoryTotal = typeof entry?.memory?.total === 'number' ? entry.memory.total : 0
+  // `requirePayload` is set by the list endpoint, which is allowed to stat the
+  // entry directory. `performRestore` itself keeps the status-only gate: it can
+  // rebuild an unrecorded memory bundle or a moved log from disk, so refusing
+  // that state at the door would break the very recovery it implements.
+  const hasPayload = hasSessionLog || hasCatalog || memoryTotal > 0 || hasLogFiles === true || hasMemoryFiles === true
   return {
     status,
-    canRestore: RESTORABLE_STATUSES.has(status),
+    canRestore: RESTORABLE_STATUSES.has(status) && (disk.requirePayload !== true || hasPayload),
     canPurge: PURGEABLE_STATUSES.has(status),
     // Discard is the escape hatch for entries that never committed: it is
     // refused while a payload copy still exists, because deleting the folder
@@ -322,9 +338,17 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
   if (!entryCapabilities(entry).canRestore) {
     throw new DeleteError('E_TRASH_CONFLICT', 'This recycle-bin entry is not in a restorable state.', { trashId: entry.trashId, status: previousStatus })
   }
-  const sessionLog = entry.sessionLog !== null && entry.sessionLog !== undefined && typeof entry.sessionLog === 'object'
+  let sessionLog = entry.sessionLog !== null && entry.sessionLog !== undefined && typeof entry.sessionLog === 'object'
     ? entry.sessionLog
     : null
+  // A crash between the log move and its manifest write leaves the log in
+  // `session/` while the manifest still says `null`. Rebuild the original path
+  // from the log header so restore can put it back instead of answering
+  // "nothing left to restore" (the discard route refuses that folder too, so
+  // without this the only copy was stranded).
+  if (sessionLog === null && typeof ops.recoverSessionLog === 'function') {
+    sessionLog = await ops.recoverSessionLog(entry).catch(() => null)
+  }
   const catalog = entry.catalog !== null && entry.catalog !== undefined && typeof entry.catalog === 'object' ? entry.catalog : null
   let memorySummary = entry.memory !== null && entry.memory !== undefined && typeof entry.memory === 'object' ? entry.memory : null
   let hasMemory = entry.includeMemory === true && memorySummary !== null && (memorySummary.total ?? 0) > 0
@@ -348,12 +372,15 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
   // that stats and moves arbitrary directories. Both sides must stay inside
   // their own storage roots.
   if (sessionLog !== null) {
+    // A caller that cannot answer "is this inside our own storage?" gets a
+    // refusal, not the benefit of the doubt: the default used to be `true`,
+    // which made the whole guard optional.
     const fromOk = typeof ops.isInsideSessionsRoot === 'function'
       ? ops.isInsideSessionsRoot(sessionLog.from) === true
-      : true
+      : false
     const toOk = typeof ops.isInsideTrashDir === 'function'
       ? ops.isInsideTrashDir(sessionLog.to) === true
-      : true
+      : false
     if (!fromOk || !toOk) {
       throw new DeleteError(
         'E_TRASH_CONFLICT',
@@ -512,13 +539,12 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
       steps.push({
         name: 'messages',
         run: async () => {
-          const moved = await ops.sessionLog.moveToTrash(session, trash.entryDir(entry.trashId))
-          try {
-            await trash.update(entry.trashId, { sessionLog: moved })
-          } catch (error) {
-            await ops.sessionLog.restoreEntry(moved).catch(() => {})
-            throw error
-          }
+          const moved = await ops.sessionLog.moveToTrash(session, trash.entryDir(entry.trashId), {
+            beforeMove: async (mapping) => {
+              await trash.update(entry.trashId, { sessionLog: mapping })
+              entry.sessionLog = mapping
+            },
+          })
           entry.sessionLog = moved
           return async () => {
             await ops.sessionLog.restoreEntry(moved)
@@ -531,6 +557,7 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
         name: 'session',
         run: async () => {
           const snapshot = await ops.catalog.capture(session)
+          await trash.update(entry.trashId, { catalog: snapshot }).catch(() => {})
           const undo = await ops.catalog.remove(session, 'hard', snapshot)
           return async () => {
             await undo()
@@ -557,6 +584,10 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
         result: result.rolledBack ? 'rolled-back' : 'rollback-incomplete',
         sessionId: entry.sessionId,
         trashId: entry.trashId,
+        // Terminal actions drop the title on purpose (a purged conversation
+        // should not live on in the audit trail), but the key stays present so
+        // consumers do not have to special-case `delete` versus `purge`.
+        title: null,
         actor,
         requestId,
         failedStep: result.failedStep,
@@ -573,6 +604,7 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
     result: 'success',
     sessionId: entry.sessionId,
     trashId: entry.trashId,
+    title: null,
     actor,
     requestId,
     durationMs: now() - startedAt,
@@ -639,6 +671,7 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
       sessionId: entry.sessionId,
       trashId: entry.trashId,
       status: entry.status,
+      title: null,
       actor,
       requestId,
       durationMs: now() - startedAt,

package/lib/core/file-lock.js

@@ -15,9 +15,13 @@
  *   - a lock whose recorded pid is provably gone is stale and is broken at
  *     once; an ownerless (foreign/legacy) lock is stale only by age;
  *   - a lock whose owner is still alive is NEVER broken by age alone: a long
- *     GC pause or a suspended process must not let a second writer in;
+ *     GC pause or a suspended process must not let a second writer in. The one
+ *     exception is a lock that has not been heartbeated for ten stale windows
+ *     (a recycled pid or a wedged holder), which is broken with a warning;
  *   - release only removes the file when it still carries this owner's nonce,
- *     so a lock broken by a peer cannot make us delete the peer's lock.
+ *     so a lock broken by a peer cannot make us delete the peer's lock. If the
+ *     removal fails, the lock is demoted to ownerless (pid: null) rather than
+ *     left recording a live pid nobody can break.
  *
  * Every iteration sleeps and re-checks the wait budget, including the
  * stale-break path: a lock file that cannot be removed (Windows exclusive
@@ -129,8 +133,22 @@ export function createFileLock({
         const deadOwner = owner.pid !== null && !isProcessAlive(owner.pid)
         // A provably dead owner is always breakable. An ownerless file (foreign
         // or legacy lock) is only breakable by age. A live owner is never
-        // broken by age: heartbeat refresh can lag behind a long GC pause.
-        const stale = deadOwner || (owner.pid === null && age > staleMs)
+        // broken by age alone: heartbeat refresh can lag behind a long GC pause.
+        //
+        // The one exception is a lock that has not been refreshed for ten stale
+        // windows. That cannot be a live holder (the heartbeat runs every few
+        // seconds), so it means a wedged process or — the common Windows case —
+        // a dead pid the OS has since handed to an unrelated process. Waiting
+        // forever on a recycled pid is worse than breaking a lock nobody owns,
+        // so it is broken loudly.
+        const recycledPid = owner.pid !== null && !deadOwner && age > staleMs * 10
+        if (recycledPid) {
+          warn(
+            `file-lock: breaking ${lockPath} — pid ${owner.pid} is alive but the lock was not refreshed for ` +
+              `${Math.round(age / 1000)}s (recycled pid or wedged holder)`,
+          )
+        }
+        const stale = deadOwner || recycledPid || (owner.pid === null && age > staleMs)
         if (stale) {
           try {
             await fsApi.rm(lockPath, { force: true })
@@ -179,10 +197,27 @@ export function createFileLock({
           try {
             await fsApi.rm(lockPath, { force: true })
           } catch (error) {
-            // A lock we could not remove stays behind; the next acquire may
-            // find it stale and also fail to break it. Say so instead of
-            // leaving a silent trap for the next mutation.
-            warn(`file-lock: could not remove ${lockPath} (${error?.code ?? 'unknown'})`)
+            // A lock we could not remove stays behind, and it records OUR pid —
+            // which is alive — so every later acquire would find a live owner,
+            // refuse to break it, and answer E_LOCK_BUSY until the process
+            // restarts. Demote it to an ownerless lock instead: the next acquire
+            // may still fail to delete it, but at least it can try, and a lock
+            // that keeps resisting is reported rather than silently poisoning
+            // the whole mutation path.
+            const canRewrite = typeof fsApi.writeFile === 'function'
+            const demoted = canRewrite
+              ? await fsApi
+                  .writeFile(lockPath, `${JSON.stringify({ pid: null, nonce: null, at: 0 })}\n`, 'utf8')
+                  .then(() => true)
+                  .catch(() => false)
+              : false
+            if (demoted === true && typeof fsApi.utimes === 'function') {
+              await fsApi.utimes(lockPath, new Date(0), new Date(0)).catch(() => {})
+            }
+            warn(
+              `file-lock: could not remove ${lockPath} (${error?.code ?? 'unknown'}); ` +
+                (demoted === true ? 'marked it ownerless so the next acquire can break it' : 'it stays owned by this process'),
+            )
           }
         }
       } finally {