dsh-conversation-recycle-bin 0.3.17 → 0.3.18

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.18] — 2026-11-04
+
+一次针对「失败之后再失败」链路的修补，加上客户端与宿主队列预算的统一。0.3.17 的评审结论是正常路径可信、错误处理链路第二层未被同等对待；这一版把 4 条可能导致数据不可逆丢失的路径、8 条一致性/健壮性缺口和文档漂移全部闭合。
+
+### Fixed
+
+- **记忆 bundle 的补偿失败会删掉唯一副本（高）**：`exportSession` 失败时先尝试把已移入 `files/` 的正文搬回原位，但 `rename` 的失败被 `.catch(() => {})` 吞掉，紧接着无条件删除整个 bundle 目录——此时 bundle 里的副本是唯一一份，索引已还原成指向不存在的路径。现在逐个记录搬回结果：全部成功才删 bundle；任一失败就保留 bundle 并写 `ORPHANED.json`（记录 adapter、sessionId、失败映射），既不丢数据也不留无法解释的残留。
+- **`restore` 从不写终态，审计一失败条目永久卡 `restoring`（中高）**：`'restored'` 只在 `PURGEABLE_STATUSES` 里出现过，没有任何写入点。恢复成功现在先提交 `status: 'restored'`（连同 `restoredAt`），再写审计；审计写失败不再把已完成的恢复报成失败，条目也不会再被重复 `catalog.restore`。内存仍有残留文件时保留条目，`memoryLeftOnDisk` 记入审计。
+- **快照缓存被就地修改（中）**：`snapshotCache` 与工作副本同一引用，`exportSession` 直接 `delete nodes[...]` / `node[field] = kept`；中途失败后缓存仍是"已删空"的样子——预览显示 0 条记忆，重试删除则静默跳过真实存在的记忆。现在在私有克隆上修改，缓存始终描述磁盘上的真实内容。
+- **三路全拒的死条目（中）**：日志头不可读且 memory 目录仍有文件时，restore 拒绝日志、discard 拒绝记忆、purge 拒绝状态，UI 没有任何按钮。`entryCapabilities` 新增 `canForceDiscard`，设置页对这类条目显示「强制清理（会丢弃记忆）」，仍要求输入 `DELETE`，审计记录 `discardedMemory: true`。`force` 只在这一种组合下被接受。
+- **审计半行会连带吞掉下一条（中低）**：`append` 直接追加，崩溃留下的半行没有换行，下一条记录与它粘成一行坏 JSON。现在追加前检查末字节，缺换行先补一个。
+- **记忆 bundle 路径没有围栏（中低）**：`restoreEntry` 直接按 manifest 的 `bundlePath` 读文件并 `rm -rf` 其目录；同 manifest 的 `from/to` 在 Host 侧是双向校验的。现在服务层接收 `bundleRoot`，越界即 `E_TRASH_CONFLICT`。
+- **客户端 195s 永远短于宿主 240s（中）**：宿主的回收站操作预算 = 锁预算 180s + 队列宽限 60s，客户端却固定 195s，浏览器先 abort，UI 报超时而后台仍在跑。四类 `/trash/*` 现在读 `/state` 下发的 `limits.queueTimeoutMs`，常量只作冷启动兜底（并改为 245s）。
+- **保留期清扫无视 `protectedSessionIds`（中）**：受保护会话过去只挡手动删除，定时清扫仍会把它的 hard 条目清掉。现在 hard/soft 都先判保护名单，命中记 `E_POLICY_PROTECTED` 并退避。
+- **会话列表读失败让整个面板 500（中）**：`loadList` 对 `controller.list`/`persistence.list` 没有异常处理，一次 5s 超时会让 `/sessions`、preview、delete 预检全部失效。现在降级为空列表并 warn。
+- **`preview` 透传记忆库绝对路径（低）**：`stores` 现在只保留 `id/label/available/reason`。
+- **配置修正静默（低）**：`clampInt` 截断小数、`memory.adapters` 非数组回退，过去都不留 warning；现在都进 `/state.warnings`。
+- **客户端细节**：补 `E_SESSION_ALIVE` 中英文案；回收站行 Restore/Purge/Discard 互斥，进行中的请求会禁用其它行内动作。
+
+### Docs
+
+- README 新增 §4.4 配置项全表（22 键、默认值与安全含义），补齐此前零提及的 9 个键。
+- 统一 `allowNonLoopback` 的说法：打开它会跳过整段 Host 校验并使 `allowedHosts` 失效，暴露到 loopback 之外应只配 `allowedHosts`。
+- 删除 README 中「`GET /trash` 会触发后台清扫」的过时描述（0.3.17 起 GET 已无副作用）。
+- `config.schema.json` 的保留期描述、`paths.js` 的 Node 版本注释、README 的宿主版本（0.2.2-alpha.3）与 `CHANGELOG` 对齐。
+- `package.json` 的 `files` 补入 `scripts/` 与 `test/`：README 与 INSTALL 指导用户运行 `npm test` 与 `node scripts/verify-host-contract.mjs`，此前从 npm 安装后两者都不存在。
+
+### Tests
+
+- `capabilities` 断言补 `canForceDiscard`；新增强制清理、restore 终态、审计半行、bundle 越界、`limits.queueTimeoutMs` 与错误码完整性用例。
+
 ## [0.3.17] — 2026-11-03
 
 针对 **dsh 0.2.2-alpha.3** 的适配性评审（安全 / 架构 / 验收三方独立只读复审）后的修复。评审本身的结论是「接口层 0 阻断、运行态未装载、行为层零证据」；这一版把其中所有能在代码里闭合的项做完，**运行态装载与破坏性链路仍需一次重启后的实测**（见 `scripts/verify-host-contract.mjs`）。
@@ -134,7 +165,7 @@ dsh-go（Android）适配性审计后的修复。审计结论：Host 半边开
 - **锁毒化（P1）**：`release()` 删不掉锁文件时，过去只 `warn` 一句就走人 —— 残留锁的 `owner.pid` 是**自己这个活进程**，而 stale 判定对活 owner 永不放行，于是下一次 `acquire()` 必定失败，之后每一次 mutation 都是 409，只能重启。现在 release 失败会把锁体降级成 `{pid: null, at: 0}`（并把 mtime 拨到纪元），下一次 acquire 按"无主且超龄"立即破锁；实在写不进去才留 warn。
 - **PID 复用**：心跳每 5 秒刷新一次 mtime，所以"十拍未刷新"（`staleMs * 10`）就按残留锁处理并告警，不再出现"这个 pid 恰好被别的进程复用、于是永远破不了锁"。
 - **队列超时不再撒谎**：计时器过去从入队一直武装到结束，操作其实已经开跑时仍返回"没有执行"。现在操作一开始就 `clearTimeout`，只有真正还在排队时才报 `E_QUEUE_TIMEOUT`。
-- **客户端预算不再比宿主早 60 秒**：`/preview` 与 `/state` 的 `limits` 新增 `queueTimeoutMs`（宿主实际使用的队列预算），客户端优先用它；过去客户端只按锁预算推算，宿主的队列预算比它多 60 秒，于是"还在跑"看起来像超时失败。
+- **客户端预算不再比宿主早 60 秒**：`/preview` 与 `/state` 的 `limits` 新增 `queueTimeoutMs`（宿主实际使用的队列预算），客户端优先用它；过去客户端只按锁预算推算，宿主的队列预算比它多 60 秒，于是"还在跑"看起来像超时失败。（0.3.18 更正：当时只有 `/delete` 真正读取了该字段，四类 `/trash/*` 仍用固定 `195s`，比宿主 `240s` 预算短——见 0.3.18。）
 - **`running` 不再被兜成 `false`**：`gateway.inspect()` 的 `running: fromList?.running ?? false` 让"宿主没说"和"已停止"无法区分，`lifecycle.js` 的 fail-closed 分支成了死代码。现在保留 `undefined`，并且 `probeRunning()` 能回答时以它为准（`agents.get(id)?.status === 'running'`）。
 - **空闲会话又能删了**：硬删闸门过去看 `live`（"宿主还知道这个会话"），空闲会话也满足，于是 `stopLiveSessions: false` 时所有空闲对话都删不掉。现在看 `session.running`；宿主不报状态时才按严格读法（未知视为在跑）。
 - **`capabilities` 不再是死字段**：回收站行的「恢复」/「彻底删除」按 `entry.capabilities.canRestore/canPurge` 置灰，不再让用户点了才知道会被拒。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.17`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.18`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 运行要求：**Node.js ≥ 22.15**（Host 侧用到 `readdir(..., { recursive: true })`、`AbortSignal` 等 22.x 行为），DSH `>=0.2.1-rc.2 <0.3.0-0`（`package.json` 的 `engines.dsh` 已如实声明，DSH 安装校验会据此拒绝范围外版本；上界是刻意的：0.2.2 与 0.3.x 之间没有承诺兼容）。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
@@ -11,7 +11,7 @@
 
 ## 1. 宿主平台规范确认（第一步）
 
-以下结论来自对当前安装的 DSH `0.2.1-rc.2`（桌面端 desktop profile）的 `cordis_inspect_query` 与实现源码核对，不是假设：
+以下结论来自对当前安装的 DSH `0.2.2-alpha.3`（桌面端 desktop profile；`0.2.1-rc.2` 起成立）的 `cordis_inspect_query` 与实现源码核对，不是假设：
 
 | 项目 | DSH 事实 | 本插件的落点 |
 |---|---|---|
@@ -150,7 +150,36 @@ memory  →  messages  →  session/catalog
       files/<nodeId>.content
 ```
 
-**保留期（自动清理）**：`trashRetentionDays`（默认 **30**）现在真的生效 —— Host 每 6 小时清扫一次（启动后 60 秒先扫一次），并且**每次打开回收站列表时在后台触发一次**（5 分钟内不重复；列表本身不等清扫，所以锁被占用也不会出现空白页）。只有 `status: 'trashed'` 且 `deletedAt` 可解析、且早于 `now - trashRetentionDays` 的条目会被清走，走的是与「永久清除」**完全相同**的 `performPurge` 路径（重新读 manifest、复判 `capabilities.canPurge`、写审计 `action: 'purge'` + `source: 'retention'`），单次最多 20 条、最旧优先，失败按指数退避重试（5 分钟起，上限 6 小时）。`pending`/`restoring`/`restored`/`purging` 与"从未提交"的残留条目**永不自动清**（那是 bug 现场，留给设置页的「恢复」/「discard」出口）；`mode: 'soft'` 且会话已被用户复活（未归档）或仍在运行的条目会跳过（无人值守时不去碰正在使用的对话），而仍处于归档状态的 soft 条目会照常清理——soft 删除本身保留日志，不再因为"日志还在"而永久逃过保留期。`trashRetentionDays: 0` 或 `enabled: false` 都会关闭清扫（后者连定时器都不注册，读接口仍然可用），条目一直留到你自己删。回收站列表里会写明"删除 N 天后自动清理"，每条显示 Host 下发的剩余天数，后台刚清过东西时还会提示清了几条。
+**保留期（自动清理）**：`trashRetentionDays`（默认 **30**）现在真的生效 —— Host 每 6 小时清扫一次（启动后 60 秒先扫一次），只有 `status: 'trashed'` 且 `deletedAt` 可解析、且早于 `now - trashRetentionDays` 的条目会被清走，走的是与「永久清除」**完全相同**的 `performPurge` 路径（重新读 manifest、复判 `capabilities.canPurge`、写审计 `action: 'purge'` + `source: 'retention'`），单次最多 20 条、最旧优先，失败按指数退避重试（5 分钟起，上限 6 小时）。`pending`/`restoring`/`restored`/`purging` 与"从未提交"的残留条目**永不自动清**（那是 bug 现场，留给设置页的「恢复」/「discard」出口）；`mode: 'soft'` 且会话已被用户复活（未归档）或仍在运行的条目会跳过（无人值守时不去碰正在使用的对话），而仍处于归档状态的 soft 条目会照常清理——soft 删除本身保留日志，不再因为"日志还在"而永久逃过保留期。`trashRetentionDays: 0` 或 `enabled: false` 都会关闭清扫（后者连定时器都不注册，读接口仍然可用），条目一直留到你自己删。回收站列表里会写明"删除 N 天后自动清理"，每条显示 Host 下发的剩余天数，后台刚清过东西时还会提示清了几条。
+
+### 4.4 配置项全表
+
+`cordis.patch.yml` 的 `config` 段共 22 个键；全部可省略，省略即取默认值。`normalizeConfig` 从不抛错：越界值被钳制、类型错误回落默认，并把每一条修正写进 `/state` 的 `warnings`（`enabled` 例外，它 fail-closed）。
+
+| 键 | 默认 | 说明 |
+|---|---|---|
+| `enabled` | `true` | 总开关。`false` 时不注册保留期定时器，且所有**写**操作返回 `E_DISABLED`；读接口仍可用，便于查看并手动清理残留条目。 |
+| `requireConnection` | `true` | 必须拿到宿主的 `connection.requestRejection` 才接受路由，否则一律 401 `E_UNAUTHORIZED`。见 §4.2 最后一行。 |
+| `requireSameOrigin` | `true` | 校验 `Origin`/`Sec-Fetch-Site`。 |
+| `allowNonLoopback` | `false` | 跳过 Host 回环校验。**打开它会让 `allowedHosts` 失效**，只在完全信任本机所有进程时使用。 |
+| `allowedHosts` | `[]` | 反代/自定义主机名白名单（`host` 或 `host:port`，最多 32 条）。暴露到 loopback 之外应只配置这一项。 |
+| `allowOrphanSessions` | `false` | 允许删除未登记到任何工作区的会话（默认按 `E_POLICY_ORPHAN` 拒绝）。 |
+| `allowSubagentSessions` | `false` | 允许删除子代理会话（默认按 `E_POLICY_SUBAGENT` 拒绝，避免拆掉正在工作的子会话）。 |
+| `protectedSessionIds` | `[]` | 永不删除、**也不被保留期自动清理**的会话 id 列表。 |
+| `allowedWorkspaceRoots` | `[]` | 非空时，会话的 workspace 路径必须落在其中一个根目录内才允许删除。 |
+| `defaultMode` | `"soft"` | 确认框初始选中的模式。 |
+| `stopLiveSessions` | `true` | `true` 时 hard 删除对 live 会话先走 `quiesce`；`false` 时直接拒绝。 |
+| `liveDrainMs` | `2000` | quiesce 等待 `running=false` 的上限，超时报 `E_POLICY_LIVE` 并回滚。 |
+| `foreignWriterGraceMs` | `1500` | 移动前复检日志 mtime 的窗口；仍在增长则报 `E_POLICY_FOREIGN_WRITER`。 |
+| `trashRetentionDays` | `30` | 回收站保留天数，`0` 关闭清扫（清扫只由定时器驱动，`GET /trash` 无副作用）。 |
+| `maxBatchSessions` | `50` | 单次批量上限；实际值还会被本分钟剩余额度收紧。 |
+| `maxDeletesPerMinute` | `20` | 滑动窗口限流，单删与批量逐项计数。 |
+| `confirmTokenTtlMs` | `120000` | `/preview` 签发的确认 token 有效期（5s–1h）。 |
+| `auditRetentionLines` | `5000` | `audit.jsonl` 保留行数，超出后压缩。 |
+| `auditMaxBytes` | `5242880`（5 MiB） | 审计文件字节上限，超出后压缩（64KB–1GB）。 |
+| `memory` | `enabled:true`、`adapters:["lingshu","generic-json","none"]`、`deleteMode:"trash"` | 记忆适配器段：`enabled`、`adapters`、`lessons`（灵枢）等。 |
+| `ui` | `showRowAction/showHeaderAction/batchDoubleConfirm` 均 `true` | 前端座位开关与批量二次确认。 |
+| `feedback` | 见 §9.2 | 反馈邮件段（非机密）。 |
 
 `manifest.status` 只允许 `pending → trashed → restoring/restored / purging`。`GET /trash` 把**所有**条目都返回：`trashed` 进 `entries`（回收站 UI，可恢复/彻底删除），其余状态进 `incomplete`（设置页单独列出，提供「恢复」与「discard」两个出口，不再出现"失败了却没有任何清理入口"的死条目）。恢复顺序是删除的逆序：日志 → catalog → 记忆。
 
@@ -248,7 +277,7 @@ node scripts/verify-host-contract.mjs http://127.0.0.1:3082 --token=<token>   #
 
 8. 路径围栏是**词法**判断（折叠 `.`/`..`、按段比较），不解析符号链接；真正的归属权威是宿主的 `workspaceRegistry`，围栏只用于「属于哪个工作区」的展示与删除前提示。若 `workspace.path` 或会话 `cwd` 本身是符号链接，判定结果可能与 `realpath` 不同。
 9. 回收站页面的保留期清理不是即时的：`GET /trash` 无副作用，过期条目由定时器（启动后 60s 首扫、之后每 6h）或用户显式 purge 移除，因此最多可能比 `trashRetentionDays` 多存活 6 小时。
-10. 宿主不校验插件前缀路由的 Origin/CSRF（0.2.2-alpha.3 实测：带 cookie 的跨站请求返回 200），鉴权由插件自己完成——cookie 会话 + 私有请求头 + `requireSameOrigin`。把 Web 暴露到 loopback 之外时必须同时配置 `allowNonLoopback` 与 `allowedHosts`。
+10. 宿主不校验插件前缀路由的 Origin/CSRF（0.2.2-alpha.3 实测：带 cookie 的跨站请求返回 200），鉴权由插件自己完成——cookie 会话 + 私有请求头 + `requireSameOrigin`。把 Web 暴露到 loopback 之外时用 `allowedHosts` 精确放行（见 §4.2 的反代表）；`allowNonLoopback: true` 会跳过整段 Host 校验、使 `allowedHosts` 失效，只应作为"我完全信任本机所有进程"的显式选择。
 11. `package.json` 的 `dsh.manifestVersion` 与 `config.schema.json` 是文档性声明，当前宿主不读取它们（全仓 grep 零命中）；`engines.dsh` 才是唯一被执行的兼容门。
 
 ---

package/client.js

@@ -128,6 +128,8 @@ window.__ModuleLoader__.load({
         'trash.discard': 'Discard',
         'trash.discarded': 'Entry removed.',
         'trash.confirmDiscard': 'Type DELETE to discard this incomplete entry.',
+        'trash.discardForce': 'Discard anyway (drops memory)',
+        'trash.confirmDiscardForce': 'The conversation log cannot be read, so this entry can never be restored. Typing DELETE also deletes the memory bundle it still holds.',
         'trash.status.pending': 'pending',
         'trash.status.failed': 'failed',
         'trash.status.restoring': 'restoring',
@@ -197,6 +199,7 @@ window.__ModuleLoader__.load({
         'error.E_POLICY_LIVE': 'The conversation could not be stopped. Close it and retry.',
         'error.E_POLICY_ORPHAN': 'The conversation is not owned by a registered workspace.',
         'error.E_POLICY_PROTECTED': 'The conversation is protected by configuration.',
+        'error.E_SESSION_ALIVE': 'The conversation is live again (revived or running), so the recycle-bin entry was left untouched.',
         'error.E_POLICY_SUBAGENT': 'Subagent conversations cannot be deleted.',
         'error.E_POLICY_ROOT': 'The conversation is outside the allowed workspace roots.',
         'error.E_RATE_LIMITED': 'Too many deletions; wait a moment and retry.',
@@ -291,6 +294,8 @@ window.__ModuleLoader__.load({
         'trash.discard': '清理',
         'trash.discarded': '条目已清理。',
         'trash.confirmDiscard': '输入 DELETE 清理该未完成条目。',
+        'trash.discardForce': '强制清理（会丢弃记忆）',
+        'trash.confirmDiscardForce': '该条目中的会话日志已无法读取，永远无法恢复。输入 DELETE 会连同它仍保存的记忆一起删除。',
         'trash.status.pending': '待处理',
         'trash.status.failed': '失败',
         'trash.status.restoring': '恢复中断',
@@ -360,6 +365,7 @@ window.__ModuleLoader__.load({
         'error.E_POLICY_LIVE': '无法停止该对话，请关闭后重试。',
         'error.E_POLICY_ORPHAN': '该对话不属于任何已登记工作区。',
         'error.E_POLICY_PROTECTED': '该对话受配置保护。',
+        'error.E_SESSION_ALIVE': '该对话已重新活跃（被恢复或正在运行），回收站条目未做处理。',
         'error.E_POLICY_SUBAGENT': '子代理对话不能删除。',
         'error.E_POLICY_ROOT': '该对话不在允许的工作区根目录内。',
         'error.E_RATE_LIMITED': '删除过于频繁，请稍后重试。',
@@ -491,15 +497,14 @@ window.__ModuleLoader__.load({
     const REQUEST_TIMEOUT_MS = 15_000
     const MUTATION_TIMEOUT_MS = 180_000
     /**
-     * Recycle-bin writes wait for the Host's cross-process lock, and that wait
-     * is unbounded in wall-clock terms: the request queues behind whatever
-     * mutation is already running (`serialize()` chains in-process first). A
-     * 15s budget therefore aborted restore / purge / discard while the Host was
-     * still working, so the UI reported a failure for a change that did happen.
-     * The Host caps its own lock wait at TRASH_LOCK_BUDGET_MS (180s); this sits
-     * just above it so the Host's own answer always wins the race.
+     * Recycle-bin writes wait for the Host's cross-process lock, and the Host's
+     * own budget for that wait is `TRASH_LOCK_BUDGET_MS` (180s) plus the 60s
+     * queue grace, published on `/state` as `limits.queueTimeoutMs` (240s).
+     * This constant is only the fallback for the window before the first
+     * `/state` read lands; it used to be 195s, i.e. 45s SHORTER than the Host,
+     * so the browser aborted an operation the Host went on to complete.
      */
-    const TRASH_MUTATION_TIMEOUT_MS = 195_000
+    const TRASH_MUTATION_TIMEOUT_MS = 245_000
     /**
      * How long a delete may run before the dialog says what it is waiting for.
      * A hard delete of a conversation written moments ago spends
@@ -1663,7 +1668,7 @@ window.__ModuleLoader__.load({
      * log) gets a Restore button: `performDiscard` refuses exactly those
      * entries, so without this the only way out was a manual API call.
      */
-    function IncompleteEntries({ entries, discardTarget, discardPhrase, onPhrase, onStart, onCancel, onDiscard, onRestore, restoreBusyId, discardBusyId = null }) {
+    function IncompleteEntries({ entries, discardTarget, discardPhrase, discardForce = false, onPhrase, onStart, onForceStart, onCancel, onDiscard, onRestore, restoreBusyId, discardBusyId = null }) {
       return h('div', { className: 'dc-panel dc-incomplete' },
         h('div', { className: 'dc-state-title' }, `${t('trash.incompleteTitle')} (${entries.length})`),
         h('p', { className: 'dc-hint' }, t('trash.incompleteHint')),
@@ -1679,6 +1684,14 @@ window.__ModuleLoader__.load({
           const canDiscard = entry.capabilities === undefined
             ? true
             : entry.capabilities?.canDiscard !== false
+          // The one state where the log can never be restored (its header is
+          // unreadable) but a memory bundle still occupies the folder: plain
+          // discard refuses it, restore refuses the log, purge refuses the
+          // status. Offering nothing left the entry on disk forever.
+          const canForceDiscard = entry.capabilities?.canForceDiscard === true
+          const openDiscard = canDiscard === true
+            ? typeof onStart === 'function' ? onStart : null
+            : canForceDiscard && typeof onForceStart === 'function' ? onForceStart : null
           return h('div', { key: entry.trashId, className: 'dc-row' },
             h('div', { className: 'dc-row-main' },
               h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId || entry.trashId),
@@ -1693,7 +1706,7 @@ window.__ModuleLoader__.load({
                   title: t('trash.restoreIncompleteHint'),
                 }, t('action.restore'))
                 : null,
-              canDiscard !== true
+              typeof openDiscard !== 'function'
                 ? null
                 : discardTarget === entry.trashId
                   ? h('span', { className: 'dc-inline-confirm' },
@@ -1714,12 +1727,13 @@ window.__ModuleLoader__.load({
                       variant: 'danger',
                       disabled: discardBusyId === entry.trashId || phraseMatches(discardPhrase, 'DELETE') !== true,
                       onClick: () => onDiscard(entry.trashId),
-                    }, t('trash.discard')),
+                    }, discardForce === true ? t('trash.discardForce') : t('trash.discard')),
                     h(Button, { disabled: discardBusyId === entry.trashId, onClick: onCancel }, t('action.cancel')))
                   : h(Button, {
-                    onClick: () => onStart(entry.trashId),
-                    title: t('trash.confirmDiscard'),
-                  }, t('trash.discard')))
+                    variant: canDiscard === true ? undefined : 'danger',
+                    onClick: () => openDiscard(entry.trashId),
+                    title: canDiscard === true ? t('trash.confirmDiscard') : t('trash.confirmDiscardForce'),
+                  }, canDiscard === true ? t('trash.discard') : t('trash.discardForce')))
           )
         }))
     }
@@ -1775,6 +1789,7 @@ window.__ModuleLoader__.load({
       const [purgePhrase, setPurgePhrase] = useState('')
       const [discardTarget, setDiscardTarget] = useState(null)
       const [discardPhrase, setDiscardPhrase] = useState('')
+      const [discardForce, setDiscardForce] = useState(false)
       const [restoreBusyId, setRestoreBusyId] = useState(null)
       const [purgeBusy, setPurgeBusy] = useState(false)
       const [discardBusyId, setDiscardBusyId] = useState(null)
@@ -1866,14 +1881,26 @@ window.__ModuleLoader__.load({
         for (const name of which) loadedRef.current[name] = -1
       }, [])
 
+      /**
+       * The Host's published budget for one trash mutation (lock + queue grace).
+       * Using the published number keeps the browser from aborting 60s before
+       * the Host gives up; the constant is a cold-start fallback only.
+       */
+      function trashTimeoutMs() {
+        const published = Number(state?.limits?.queueTimeoutMs)
+        return Number.isFinite(published) && published > 0 ? Math.max(1_000, published) : TRASH_MUTATION_TIMEOUT_MS
+      }
+
       async function restore(trashId) {
+        if (restoreBusyId !== null) return
+        setRestoreBusyId(trashId)
         setError(null)
         const entry = trash.find((item) => item.trashId === trashId)
         try {
           await api('/trash/restore', {
             method: 'POST',
             body: { trashId },
-            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+            timeoutMs: trashTimeoutMs(),
           })
           flashStore.show(t('trash.restored'))
           markStale('trash', 'batch')
@@ -1885,6 +1912,8 @@ window.__ModuleLoader__.load({
           })
         } catch (caught) {
           setError(caught)
+        } finally {
+          setRestoreBusyId(null)
         }
       }
 
@@ -1901,7 +1930,7 @@ window.__ModuleLoader__.load({
           await api('/trash/restore', {
             method: 'POST',
             body: { trashId },
-            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+            timeoutMs: trashTimeoutMs(),
           })
           flashStore.show(t('trash.restored'))
           markStale('trash', 'batch')
@@ -1929,7 +1958,7 @@ window.__ModuleLoader__.load({
           await api('/trash/purge', {
             method: 'POST',
             body: { trashId, confirmPhrase: phrase },
-            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+            timeoutMs: trashTimeoutMs(),
           })
           flashStore.show(t('trash.purged'))
           setPurgeTarget(null)
@@ -1949,15 +1978,15 @@ window.__ModuleLoader__.load({
         }
       }
 
-      async function discard(trashId, phrase) {
+      async function discard(trashId, phrase, force = false) {
         if (discardBusyId !== null) return
         setDiscardBusyId(trashId)
         setError(null)
         try {
           await api('/trash/discard', {
             method: 'POST',
-            body: { trashId, confirmPhrase: phrase },
-            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+            body: { trashId, confirmPhrase: phrase, force: force === true },
+            timeoutMs: trashTimeoutMs(),
           })
           flashStore.show(t('trash.discarded'))
           setDiscardTarget(null)
@@ -1989,6 +2018,10 @@ window.__ModuleLoader__.load({
       // banner and the per-row hint come from `retentionInfo`, which reads the
       // field where the Host actually sends it (`limits`).
       const retentionDays = retentionInfo(state).days
+      // One trash mutation at a time: the Host serializes them anyway, so a
+      // second click only queued another request behind the first and its error
+      // overwrote the first one's success flash.
+      const trashActionBusy = restoreBusyId !== null || purgeBusy === true || discardBusyId !== null
       const expiryHint = (entry) => {
         const left = retentionInfo(state, entry).daysLeft
         if (left === null) return ''
@@ -2072,7 +2105,7 @@ window.__ModuleLoader__.load({
               // The Host already knows whether this entry can be restored;
               // the panel used to offer the button and then show the refusal.
               h(Button, {
-                disabled: entry.capabilities?.canRestore === false,
+                disabled: entry.capabilities?.canRestore === false || trashActionBusy,
                 title: entry.capabilities?.canRestore === false ? t('error.E_TRASH_CONFLICT') : t('action.restore'),
                 onClick: () => { void restore(entry.trashId) },
               }, t('action.restore')),
@@ -2093,7 +2126,7 @@ window.__ModuleLoader__.load({
                   h(Button, { disabled: purgeBusy === true, onClick: () => { setPurgeTarget(null); setPurgePhrase('') } }, t('action.cancel')))
                 : h(Button, {
                   variant: 'danger',
-                  disabled: entry.capabilities?.canPurge === false,
+                  disabled: entry.capabilities?.canPurge === false || trashActionBusy,
                   title: entry.capabilities?.canPurge === false ? t('error.E_TRASH_CONFLICT') : t('action.purge'),
                   onClick: () => { setPurgeTarget(entry.trashId); setPurgePhrase('') },
                 }, t('action.purge')))))) : null,
@@ -2102,10 +2135,12 @@ window.__ModuleLoader__.load({
           entries: incomplete,
           discardTarget,
           discardPhrase,
+          discardForce,
           onPhrase: setDiscardPhrase,
-          onStart: (trashId) => { setDiscardTarget(trashId); setDiscardPhrase('') },
-          onCancel: () => { setDiscardTarget(null); setDiscardPhrase('') },
-          onDiscard: (trashId) => { void discard(trashId, discardPhrase.trim()) },
+          onStart: (trashId) => { setDiscardTarget(trashId); setDiscardPhrase(''); setDiscardForce(false) },
+          onForceStart: (trashId) => { setDiscardTarget(trashId); setDiscardPhrase(''); setDiscardForce(true) },
+          onCancel: () => { setDiscardTarget(null); setDiscardPhrase(''); setDiscardForce(false) },
+          onDiscard: (trashId) => { void discard(trashId, discardPhrase.trim(), discardForce) },
           onRestore: (trashId) => { void restoreIncomplete(trashId) },
           restoreBusyId,
           discardBusyId,

package/config.schema.json

@@ -28,7 +28,7 @@
       "description": "When non-empty, a session may only be deleted when its workspace path is inside one of these roots."
     },
     "defaultMode": { "enum": ["soft", "hard"], "default": "soft", "description": "Initial mode selected in the confirmation dialog." },
-    "trashRetentionDays": { "type": "number", "minimum": 0, "maximum": 3650, "default": 30, "description": "Days a committed recycle-bin entry is kept before the Host purges it automatically (checked every six hours and whenever /trash is listed). 0 disables the sweep, leaving entries until the user purges them." },
+    "trashRetentionDays": { "type": "number", "minimum": 0, "maximum": 3650, "default": 30, "description": "Days a committed recycle-bin entry is kept before the Host purges it automatically (checked by a background timer: once 60s after start, then every six hours). 0 disables the sweep, leaving entries until the user purges them." },
     "maxBatchSessions": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 50, "description": "Upper bound on one batch. The effective limit is min(this, remaining deletions in the current minute), so a batch can never exceed the rate budget." },
     "maxDeletesPerMinute": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 20, "description": "Sliding-window limit for conversation deletions (single and batch items count individually)." },
     "confirmTokenTtlMs": { "type": "integer", "minimum": 5000, "maximum": 3600000, "default": 120000 },

package/lib/core/audit.js

@@ -57,6 +57,34 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
     await fsApi.rename(temporary, filePath)
   }
 
+  /**
+   * A crash between `write` and `write` can leave the file ending in a partial
+   * line. Appending `line\n` on top of that fragment glues the fragment to the
+   * new record and BOTH become unparseable, so one torn tail used to cost the
+   * next record too. Terminate the fragment first: it is already unreadable, but
+   * it stays isolated on its own line.
+   */
+  async function ensureTrailingNewline() {
+    let handle
+    try {
+      handle = await fsApi.open(filePath, 'r')
+    } catch (error) {
+      if (error?.code === 'ENOENT') return
+      throw error
+    }
+    try {
+      const { size } = await handle.stat()
+      if (size === 0) return
+      const last = Buffer.alloc(1)
+      const read = await handle.read(last, 0, 1, size - 1)
+      if (read.bytesRead === 1 && last[0] !== 0x0a) {
+        await fsApi.appendFile(filePath, '\n', 'utf8')
+      }
+    } finally {
+      await handle.close()
+    }
+  }
+
   return {
     filePath,
 
@@ -71,6 +99,7 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
         const line = JSON.stringify({ ...record, at: record.at ?? now() })
         await fsApi.mkdir(dirname(filePath), { recursive: true })
         await compactIfNeeded(Buffer.byteLength(line, 'utf8') + 1)
+        await ensureTrailingNewline()
         await fsApi.appendFile(filePath, `${line}\n`, 'utf8')
         return line
       })

package/lib/core/cascade.js

@@ -321,6 +321,11 @@ export function entryCapabilities(entry, disk = {}) {
     // exception is a log whose header cannot be read — nothing can use it any
     // more, so discarding is the only way to get the disk space back.
     canDiscard: status !== 'trashed' && hasMemoryFiles !== true && (unrecoverable || hasLogFiles !== true),
+    // A log nobody can read AND a memory bundle still on disk used to lock the
+    // entry out of all three actions: restore refused the log, discard refused
+    // the memory, purge refused the status. This flag marks the one state where
+    // a forced discard (explicit, phrase-confirmed) is the remaining exit.
+    canForceDiscard: status !== 'trashed' && hasMemoryFiles === true && unrecoverable === true,
   }
 }
 
@@ -495,18 +500,6 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
     throw toDeleteError(result, { sessionId: entry.sessionId, title: entry.title })
   }
 
-  await audit.append({
-    id: `${entry.trashId}:restore`,
-    action: 'restore',
-    result: 'success',
-    sessionId: entry.sessionId,
-    title: entry.title,
-    trashId: entry.trashId,
-    actor,
-    requestId,
-    durationMs: now() - startedAt,
-    source,
-  })
   // Only clear the entry directory once its memory bundles are actually gone.
   // `restoreEntry` removes the bundles it consumed; if memory files are still
   // there (an adapter was uninstalled, a bundle was unreadable) removing the
@@ -514,7 +507,33 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
   const memoryFilesLeft = typeof ops.hasFiles === 'function' && typeof trash?.entryDir === 'function'
     ? await ops.hasFiles(join(trash.entryDir(entry.trashId), 'memory')).catch(() => true)
     : false
-  if (!memoryFilesLeft) await trash.remove(entry.trashId).catch(() => {})
+  // Commit the terminal state BEFORE the audit write. `restored` used to be
+  // declared in PURGEABLE_STATUSES but never written, so a successful restore
+  // left the manifest in `restoring`: the row could be restored again (a second
+  // catalog.restore) and could never be purged. A failed audit write used to
+  // keep it there as well — the data was already back on disk.
+  if (memoryFilesLeft) {
+    await trash.update(entry.trashId, { status: 'restored', restoredAt: now() }).catch(() => {})
+  } else {
+    await trash.remove(entry.trashId).catch(() => {})
+  }
+  await audit
+    .append({
+      id: `${entry.trashId}:restore`,
+      action: 'restore',
+      result: 'success',
+      sessionId: entry.sessionId,
+      title: entry.title,
+      trashId: entry.trashId,
+      memoryLeftOnDisk: memoryFilesLeft,
+      actor,
+      requestId,
+      durationMs: now() - startedAt,
+      source,
+    })
+    // The restore is already committed; reporting an audit-only failure as a
+    // failed restore would invite a retry that the `restored` state now refuses.
+    .catch(() => {})
   return { trashId: entry.trashId, sessionId: entry.sessionId, memoryLeftOnDisk: memoryFilesLeft }
 }
 
@@ -675,8 +694,10 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
  * @param {() => number} [input.now]
  * @param {string} [input.actor]
  * @param {string} [input.requestId]
+ * @param {boolean} [input.force] allow discarding an unreadable log together with
+ *   its memory bundle (see `entryCapabilities().canForceDiscard`)
  */
-export async function performDiscard({ entry, ops, trash, audit, now = Date.now, actor = 'local-user', source = 'web-ui', requestId = null }) {
+export async function performDiscard({ entry, ops, trash, audit, now = Date.now, actor = 'local-user', source = 'web-ui', requestId = null, force = false }) {
   if (entry.status === 'trashed') {
     throw new DeleteError('E_TRASH_CONFLICT', 'This entry is a committed deletion; restore or purge it instead of discarding it.', {
       trashId: entry.trashId,
@@ -719,11 +740,19 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
     payloadRecoverable: logUnrecoverable ? false : null,
   })
   if (holdsMemory || !capabilities.canDiscard) {
-    const which = holdsMemory ? 'memory files' : 'payload'
-    throw new DeleteError('E_TRASH_CONFLICT', `This incomplete entry still holds ${which}; restore or purge it instead of discarding it.`, {
-      trashId: entry.trashId,
-      status: entry.status,
-    })
+    // The exit for the all-refused state: a log whose header cannot be read can
+    // never be restored, and its memory bundle therefore cannot be restored
+    // either. Refusing `force` outside exactly that combination keeps this from
+    // becoming a generic "skip the safety check" switch.
+    const forceAllowed = force === true && logUnrecoverable === true
+    if (!forceAllowed) {
+      const which = holdsMemory ? 'memory files' : 'payload'
+      throw new DeleteError('E_TRASH_CONFLICT', `This incomplete entry still holds ${which}; restore or purge it instead of discarding it.`, {
+        trashId: entry.trashId,
+        status: entry.status,
+        forceable: capabilities.canForceDiscard === true,
+      })
+    }
   }
   const startedAt = now()
   await trash.remove(entry.trashId)
@@ -736,6 +765,9 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
       trashId: entry.trashId,
       status: entry.status,
       title: null,
+      // Record that the forced path destroyed a memory bundle the caller could
+      // not restore, so the audit trail explains an otherwise silent loss.
+      discardedMemory: force === true && holdsMemory === true,
       actor,
       requestId,
       durationMs: now() - startedAt,

package/lib/core/config.js

@@ -112,6 +112,12 @@ function clampInt(raw, fallback, min, max, field, warnings) {
     return fallback
   }
   const rounded = Math.round(number)
+  // A fractional value is a config mistake with a silent consequence: 0.4 days
+  // rounds to 0, and 0 is the documented "keep forever" spelling. Report the
+  // rounding instead of accepting a value that means something else.
+  if (rounded !== number) {
+    warnings.push(`${field}: ${number} is not an integer, rounded to ${rounded}`)
+  }
   if (rounded < min || rounded > max) {
     warnings.push(`${field}: ${rounded} outside [${min}, ${max}], clamped`)
     return Math.min(max, Math.max(min, rounded))
@@ -242,13 +248,25 @@ export function normalizeConfig(raw) {
     warnings.push(`defaultMode: expected soft|hard, using ${DEFAULTS.defaultMode}`)
   }
 
-  const adapters = Array.isArray(memoryRaw.adapters)
-    ? memoryRaw.adapters.filter((id) => ADAPTER_IDS.has(id))
-    : [...DEFAULTS.memory.adapters]
-  if (Array.isArray(memoryRaw.adapters) && adapters.length !== memoryRaw.adapters.length) {
-    warnings.push('memory.adapters: unsupported adapter ids were dropped')
+  let adapters
+  if (memoryRaw.adapters === undefined) {
+    adapters = [...DEFAULTS.memory.adapters]
+  } else if (!Array.isArray(memoryRaw.adapters)) {
+    // A string here used to fall back to the default silently, so a typo such
+    // as `adapters: "lingshu"` left the operator believing only that adapter
+    // was in play.
+    warnings.push('memory.adapters: expected an array of adapter ids, using the default')
+    adapters = [...DEFAULTS.memory.adapters]
+  } else {
+    adapters = memoryRaw.adapters.filter((id) => ADAPTER_IDS.has(id))
+    if (adapters.length !== memoryRaw.adapters.length) {
+      warnings.push('memory.adapters: unsupported adapter ids were dropped')
+    }
+  }
+  if (adapters.length === 0) {
+    warnings.push('memory.adapters: no usable adapter, using none')
+    adapters.push('none')
   }
-  if (adapters.length === 0) adapters.push('none')
 
   const deleteMode = MEMORY_DELETE_MODES.has(memoryRaw.deleteMode)
     ? memoryRaw.deleteMode