dsh-conversation-recycle-bin 0.3.18 → 0.3.19

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.19] — 2026-11-05
+
+平台审计（架构 / 安全 / 验收三方独立复审 v0.3.18）之后的修复。三方从不同角度撞到同一处：**记忆残留的条目在 UI/API 上没有任何出口**；另有一条把瞬时读失败当永久不可恢复。
+
+### Fixed
+
+- **失败导出的残留变成可恢复**（架构 P2 / 验收 R-21-01）：`bundle.json` 过去只在整个搬移循环结束后才写，若在此之前失败且补偿搬回也失败，目录只剩 `files/` 与 `ORPHANED.json` —— `readExported` 只认 bundle，restore 无物可读、discard 拒绝文件、force 又要求"日志不可读"，条目永久留盘。现在补偿决定保留时**同时写一份 rescue bundle**（用仍留在 `files/` 的条目重建），让恢复重新有路。
+- **索引已有节点、内容仍在 bundle 时不再拒绝恢复**（同一根因的另一半）：失败导出会把索引还原成 pristine（节点还在），旧逻辑看到"节点已存在"就直接 `E_TRASH_CONFLICT`；现在若内容文件仍在 bundle 里，就把它搬回并视为已恢复。
+- **`restored` 残留条目有了 purge 入口**（架构 ARCH-02 / 验收 R-21-02）：恢复成功但 `memory/` 仍有文件时，条目落在"未完成条目"面板，Restore/Discard/Force 全不可用，而 API 的 purge 其实允许。`IncompleteEntries` 现在对 `canPurge === true` 渲染 purge（沿用 `DELETE` 短语确认）。
+- **瞬时读失败不再被当成永久不可恢复**（安全 S-01）：`recoverSessionLog`/`readSessionLogCwd` 过去把所有错误吞成 `null`，于是 EACCES/EBUSY（杀软、备份锁）也会让列表隐藏 Restore 并提供"强制清理（会丢弃记忆）"。现在只有 `ENOENT`/`ENOTDIR` 与解析失败算"确实读不出"，`EACCES`/`EPERM`/`EBUSY`/`EMFILE`/`ENFILE`/`EAGAIN` 一律按瞬时处理：能力位保持 `canRestore`、不给 force，恢复时提示"稍后重试"。
+- **stranded 记忆成为第三种 force 场景**（架构 ARCH-01 的出口）：`entryCapabilities` 新增 `strandedMemory`，与"日志不可读"同级允许 `canForceDiscard`（仍需 `DELETE` 短语）。
+
+### Changed
+
+- **内联确认框改为订阅 seat 状态**：`overlaySeatMounted` 布尔换成 `overlaySeatStore`（订阅式），`DialogHost` 挂载即发布，面板同帧让位；不再依赖 250ms 轮询，消除了双渲染窗口（架构 ARCH-06 / 安全 S-03）。
+- **`lastSweep` 显示相对时间**："Host 已在后台自动清理 N 条"补上 `{when}`（刚刚 / N 分钟前 / N 小时前 / N 天前），避免把 6 小时前的结果当成刚刚发生。
+- `audit.append` 的文档补上契约：**调用方必须已持有跨进程 mutation 锁**（`serialize()` 只排本进程的顺序，补换行读末字节与另一 Host 的追加会交错）。
+
+### Tests
+
+- `test/cascade.test.mjs`（30 → 32）：stranded 记忆开启 force 出口 / 无 stranded 时不开启；force 在 stranded 下被接受、无 stranded 时拒绝且 `forceable` 不置位；瞬时 `EBUSY` 时 restore 提示重试、discard 不把 force 打开。
+- `test/memory.test.mjs`（18 → 19）：导出失败 + 补偿搬回失败 → 留下可用的 rescue bundle，且 `restoreBundle` 能把内容搬回。
+- `test/client-module.test.mjs`（29 → 31）：`canPurge` 时渲染 purge（无该能力时不渲染任何破坏性动作）；`formatAgo` 的相对时间文案。
+- `test/api.test.mjs`（68 → 70）：Origin 栅栏矩阵（127/localhost 混用 403、缺 Host 403、`dsh-app://app` 豁免、跨站拒绝）；端到端验证 stranded 条目被列出为 `strandedMemory` 且 `force:true` 的 discard 被接受（不带 force 仍 409）。
+- 合计 213 → **221**。
+
 ## [0.3.18] — 2026-11-04
 
 一次针对「失败之后再失败」链路的修补，加上客户端与宿主队列预算的统一。0.3.17 的评审结论是正常路径可信、错误处理链路第二层未被同等对待；这一版把 4 条可能导致数据不可逆丢失的路径、8 条一致性/健壮性缺口和文档漂移全部闭合。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.18`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.19`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 运行要求：**Node.js ≥ 22.15**（Host 侧用到 `readdir(..., { recursive: true })`、`AbortSignal` 等 22.x 行为），DSH `>=0.2.1-rc.2 <0.3.0-0`（`package.json` 的 `engines.dsh` 已如实声明，DSH 安装校验会据此拒绝范围外版本；上界是刻意的：0.2.2 与 0.3.x 之间没有承诺兼容）。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。

package/client.js

@@ -116,6 +116,11 @@ window.__ModuleLoader__.load({
         'trash.expiresIn': 'auto-purged in {days} d',
         'trash.expiresSoon': 'auto-purged on the next check',
         'trash.swept': 'The Host cleaned up {count} expired entries in the background.',
+        'trash.sweptAgo': 'The Host cleaned up {count} expired entries {when}.',
+        'time.justNow': 'just now',
+        'time.minutesAgo': '{count} min ago',
+        'time.hoursAgo': '{count} h ago',
+        'time.daysAgo': '{count} d ago',
         'trash.modeSoft': 'soft',
         'trash.modeHard': 'permanent',
         'trash.items': '{sessions} conversation(s) · {memories} memory entries',
@@ -125,6 +130,7 @@ window.__ModuleLoader__.load({
         'trash.incompleteTitle': 'Incomplete entries',
         'trash.incompleteHint': 'Entries that never committed. Discard them to free the space; an entry that still holds a conversation log must be restored or purged instead.',
         'trash.restoreIncompleteHint': 'Put the conversation log back and re-attach it to its workspace.',
+        'trash.purgeIncompleteHint': 'Delete this entry and everything still inside it. Type DELETE to confirm.',
         'trash.discard': 'Discard',
         'trash.discarded': 'Entry removed.',
         'trash.confirmDiscard': 'Type DELETE to discard this incomplete entry.',
@@ -282,6 +288,11 @@ window.__ModuleLoader__.load({
         'trash.expiresIn': '{days} 天后自动清理',
         'trash.expiresSoon': '下次检查时自动清理',
         'trash.swept': 'Host 已在后台自动清理 {count} 条过期条目。',
+        'trash.sweptAgo': 'Host 已在{when}自动清理 {count} 条过期条目。',
+        'time.justNow': '刚刚',
+        'time.minutesAgo': '{count} 分钟前',
+        'time.hoursAgo': '{count} 小时前',
+        'time.daysAgo': '{count} 天前',
         'trash.modeSoft': '软删除',
         'trash.modeHard': '彻底',
         'trash.items': '{sessions} 个对话 · {memories} 条记忆',
@@ -291,6 +302,7 @@ window.__ModuleLoader__.load({
         'trash.incompleteTitle': '未完成条目',
         'trash.incompleteHint': '这些条目没有提交成功，可直接清理以释放空间；仍保存着会话日志的条目请先恢复或彻底删除。',
         'trash.restoreIncompleteHint': '把会话日志放回原位，并重新挂回它所属的工作区。',
+        'trash.purgeIncompleteHint': '彻底删除该条目及其中残留的内容，需要输入 DELETE 确认。',
         'trash.discard': '清理',
         'trash.discarded': '条目已清理。',
         'trash.confirmDiscard': '输入 DELETE 清理该未完成条目。',
@@ -704,34 +716,28 @@ window.__ModuleLoader__.load({
      * only confirmation dialog the delete flow had. Settings still gets a page
      * island, so the panel can render that same dialog inline instead of
      * pretending the button did nothing.
+     *
+     * A store, not a poll: the panel and the host must flip in the same frame,
+     * otherwise both copies of the dialog render for a tick.
      */
-    let overlaySeatMounted = false
+    const overlaySeatStore = {
+      mounted: false,
+      listeners: new Set(),
+      subscribe(listener) {
+        this.listeners.add(listener)
+        return () => this.listeners.delete(listener)
+      },
+      set(mounted) {
+        const next = mounted === true
+        if (this.mounted === next) return
+        this.mounted = next
+        for (const listener of this.listeners) listener(next)
+      },
+    }
 
     function useOverlaySeatPresent() {
-      const [present, setPresent] = useState(overlaySeatMounted === true)
-      useEffect(() => {
-        if (overlaySeatMounted === true) {
-          setPresent(true)
-          return undefined
-        }
-        // The overlay host mounts with the shell, but nothing guarantees it is
-        // already there when this panel first renders: poll briefly so a late
-        // mount still wins over the inline copy instead of rendering both.
-        let timer = null
-        const tick = () => {
-          if (overlaySeatMounted !== true) return
-          if (timer !== null) clearInterval(timer)
-          setPresent(true)
-        }
-        timer = setInterval(tick, 250)
-        const stop = setTimeout(() => {
-          if (timer !== null) clearInterval(timer)
-        }, 10_000)
-        return () => {
-          if (timer !== null) clearInterval(timer)
-          clearTimeout(stop)
-        }
-      }, [])
+      const [present, setPresent] = useState(overlaySeatStore.mounted)
+      useEffect(() => overlaySeatStore.subscribe(setPresent), [])
       return present
     }
 
@@ -1028,6 +1034,25 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * "3 hours ago"-style label for the last background sweep.
+     *
+     * The sweep only runs on the Host's own timer, so the same result stays in
+     * `lastSweep` for up to six hours. Rendering it without a time made users
+     * think the entries had just been deleted on the refresh they had in front
+     * of them.
+     */
+    function formatAgo(value, nowMs = Date.now()) {
+      if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return ''
+      const seconds = Math.max(0, Math.round((nowMs - value) / 1000))
+      if (seconds < 60) return t('time.justNow')
+      const minutes = Math.round(seconds / 60)
+      if (minutes < 60) return t('time.minutesAgo', { count: minutes })
+      const hours = Math.round(minutes / 60)
+      if (hours < 24) return t('time.hoursAgo', { count: hours })
+      return t('time.daysAgo', { count: Math.round(hours / 24) })
+    }
+
     /**
      * The recycle-bin retention window, read from the Host payload.
      *
@@ -1588,9 +1613,11 @@ window.__ModuleLoader__.load({
       const payload = useDialogState()
       const flash = useFlashMessage()
       useEffect(() => {
-        overlaySeatMounted = true
+        // Publishing synchronously on mount is what keeps the inline copy from
+        // rendering alongside this one: the panel is subscribed, not polling.
+        overlaySeatStore.set(true)
         return () => {
-          overlaySeatMounted = false
+          overlaySeatStore.set(false)
         }
       }, [])
       // `kind` is optional: every pre-0.2.2 caller opens a delete dialog, so a
@@ -1668,7 +1695,7 @@ window.__ModuleLoader__.load({
      * log) gets a Restore button: `performDiscard` refuses exactly those
      * entries, so without this the only way out was a manual API call.
      */
-    function IncompleteEntries({ entries, discardTarget, discardPhrase, discardForce = false, onPhrase, onStart, onForceStart, onCancel, onDiscard, onRestore, restoreBusyId, discardBusyId = null }) {
+    function IncompleteEntries({ entries, discardTarget, discardPhrase, discardForce = false, onPhrase, onStart, onForceStart, onCancel, onDiscard, onRestore, restoreBusyId, discardBusyId = null, purgeTarget = null, purgePhrase = '', onPurgePhrase, onPurgeStart, onPurgeCancel, onPurge, purgeBusyId = null }) {
       return h('div', { className: 'dc-panel dc-incomplete' },
         h('div', { className: 'dc-state-title' }, `${t('trash.incompleteTitle')} (${entries.length})`),
         h('p', { className: 'dc-hint' }, t('trash.incompleteHint')),
@@ -1706,6 +1733,34 @@ window.__ModuleLoader__.load({
                   title: t('trash.restoreIncompleteHint'),
                 }, t('action.restore'))
                 : null,
+              // A restored entry that still holds memory files is purgeable by
+              // the API but was not reachable from this panel: it rendered no
+              // action at all. Offer the same confirmed purge the trash rows use.
+              entry.capabilities?.canPurge === true && typeof onPurge === 'function'
+                ? purgeTarget === entry.trashId
+                  ? h('span', { className: 'dc-inline-confirm' },
+                    h('input', {
+                      type: 'text',
+                      value: purgePhrase,
+                      placeholder: 'DELETE',
+                      className: 'dc-input dc-input-small',
+                      onChange: (event) => onPurgePhrase(event.target.value),
+                      autoCapitalize: 'characters',
+                      autoCorrect: 'off',
+                      spellCheck: false,
+                    }),
+                    h(Button, {
+                      variant: 'danger',
+                      disabled: purgeBusyId === entry.trashId || phraseMatches(purgePhrase, 'DELETE') !== true,
+                      onClick: () => onPurge(entry.trashId),
+                    }, t('action.purge')),
+                    h(Button, { disabled: purgeBusyId === entry.trashId, onClick: onPurgeCancel }, t('action.cancel')))
+                  : h(Button, {
+                    variant: 'danger',
+                    onClick: () => onPurgeStart(entry.trashId),
+                    title: t('trash.purgeIncompleteHint'),
+                  }, t('action.purge'))
+                : null,
               typeof openDiscard !== 'function'
                 ? null
                 : discardTarget === entry.trashId
@@ -2093,7 +2148,9 @@ window.__ModuleLoader__.load({
         tab === 'trash' ? h('div', { id: 'dc-panel-trash', role: 'tabpanel', 'aria-labelledby': 'dc-tab-trash', className: 'dc-panel' },
           retentionDays > 0 ? h('div', { className: 'dc-hint dc-hint-block' }, t('trash.retention', { days: retentionDays })) : null,
           Number(lastSweep?.purged) > 0
-            ? h('div', { className: 'dc-hint dc-hint-block' }, t('trash.swept', { count: Number(lastSweep.purged) }))
+            ? h('div', { className: 'dc-hint dc-hint-block' }, typeof lastSweep?.at === 'number'
+              ? t('trash.sweptAgo', { count: Number(lastSweep.purged), when: formatAgo(lastSweep.at) })
+              : t('trash.swept', { count: Number(lastSweep.purged) }))
             : null,
           trash.length === 0 ? h('div', { className: 'dc-empty' }, t('trash.empty')) : null,
           ...trash.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
@@ -2144,6 +2201,13 @@ window.__ModuleLoader__.load({
           onRestore: (trashId) => { void restoreIncomplete(trashId) },
           restoreBusyId,
           discardBusyId,
+          purgeTarget,
+          purgePhrase,
+          purgeBusyId: purgeBusy === true ? purgeTarget : null,
+          onPurgePhrase: setPurgePhrase,
+          onPurgeStart: (trashId) => { setPurgeTarget(trashId); setPurgePhrase('') },
+          onPurgeCancel: () => { setPurgeTarget(null); setPurgePhrase('') },
+          onPurge: (trashId) => { void purge(trashId, purgePhrase.trim()) },
         }) : null,
 
         tab === 'batch' ? h('div', { id: 'dc-panel-batch', role: 'tabpanel', 'aria-labelledby': 'dc-tab-batch', className: 'dc-panel' },
@@ -2404,7 +2468,8 @@ window.__ModuleLoader__.load({
     // guard changes the outcome.
     exports.__phraseMatches = phraseMatches
     exports.__httpFallbackError = httpFallbackError
-    exports.__overlaySeatState = () => ({ mounted: overlaySeatMounted })
+    exports.__overlaySeatState = () => ({ mounted: overlaySeatStore.mounted })
+    exports.__formatAgo = formatAgo
     return module.exports
   },
 })

package/lib/core/audit.js

@@ -93,6 +93,15 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
      * deletion whose audit write fails must be reported as a failed operation,
      * because "traceable" is part of the contract. Callers run the audit write
      * inside the same transaction step so a failure rolls the deletion back.
+     *
+     * CONTRACT: every caller must already hold the cross-process mutation lock
+     * (`<dataDir>/mutation.lock`). `serialize()` only orders appends inside THIS
+     * process; the trailing-newline repair below reads the last byte and then
+     * appends, which interleaves with a second Host (desktop + `dsh web` share
+     * one DSH_HOME) unless that lock is held. Every current call site (delete,
+     * restore, purge, discard, retention sweep) is inside it — a new caller that
+     * is not must take the lock first, or its record can be glued to another
+     * process's torn tail line.
      */
     append(record) {
       return serialize(async () => {

package/lib/core/cascade.js

@@ -303,6 +303,10 @@ export function entryCapabilities(entry, disk = {}) {
   // Unreadable log ≠ restorable log. Offering restore here produced a button
   // that always failed with "discard it", while discard itself refused.
   const unrecoverable = disk.payloadRecoverable === false
+  // `memory/<adapter>/` holds files but no readable bundle: the export died
+  // before it could write one. Nothing can restore that adapter, so the entry
+  // needs the same explicit exit as an unreadable log.
+  const stranded = disk.strandedMemory === true
   const hasSessionLog = entry?.sessionLog !== null && entry?.sessionLog !== undefined
   const hasCatalog = entry?.catalog !== null && entry?.catalog !== undefined
   const memoryTotal = typeof entry?.memory?.total === 'number' ? entry.memory.total : 0
@@ -325,7 +329,9 @@ export function entryCapabilities(entry, disk = {}) {
     // entry out of all three actions: restore refused the log, discard refused
     // the memory, purge refused the status. This flag marks the one state where
     // a forced discard (explicit, phrase-confirmed) is the remaining exit.
-    canForceDiscard: status !== 'trashed' && hasMemoryFiles === true && unrecoverable === true,
+    canForceDiscard: status !== 'trashed' && hasMemoryFiles === true && (unrecoverable === true || stranded === true),
+    // Surfaced so the panel can explain WHY the forced exit is offered.
+    strandedMemory: stranded,
   }
 }
 
@@ -360,7 +366,17 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
   // "nothing left to restore" (the discard route refuses that folder too, so
   // without this the only copy was stranded).
   if (sessionLog === null && typeof ops.recoverSessionLog === 'function') {
-    sessionLog = await ops.recoverSessionLog(entry).catch(() => null)
+    try {
+      sessionLog = await ops.recoverSessionLog(entry)
+    } catch (error) {
+      // A locked or briefly unreadable log is not a missing one: the right
+      // answer is "try again", not "this can never be restored".
+      throw new DeleteError('E_TRASH_CONFLICT', 'The conversation log could not be read right now (another process may hold it); retry in a moment.', {
+        trashId: entry.trashId,
+        reason: 'log-read-transient',
+        cause: error instanceof Error ? error.message : String(error),
+      })
+    }
   }
   // If the log copy is on disk but its header cannot be read (truncated, wrong
   // codec, missing `cwd`), there is no path to put it back to and no state it
@@ -716,7 +732,13 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
   // it left the entry stuck in `pending` forever.
   let logUnrecoverable = false
   if (holdsLog === true && (entry.sessionLog === null || entry.sessionLog === undefined) && typeof ops.recoverSessionLog === 'function') {
-    logUnrecoverable = (await ops.recoverSessionLog(entry).catch(() => null)) === null
+    try {
+      logUnrecoverable = (await ops.recoverSessionLog(entry)) === null
+    } catch {
+      // Transient read failure: the log may still be restorable, so this must
+      // not open the forced-discard exit (which deletes the memory bundle).
+      logUnrecoverable = false
+    }
   }
   if (holdsLog === true && !logUnrecoverable) {
     throw new DeleteError('E_TRASH_CONFLICT', 'This incomplete entry still holds the conversation log; restore or purge it instead of discarding it.', {
@@ -732,19 +754,26 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
   } else {
     holdsMemory = entry.includeMemory === true && (entry.memory?.total ?? 0) > 0
   }
+  // Files without a readable bundle cannot be restored by anything: that is the
+  // second state where a forced, phrase-confirmed discard is the only exit.
+  let strandedMemory = false
+  if (holdsMemory === true && typeof ops.hasStrandedMemory === 'function') {
+    strandedMemory = await ops.hasStrandedMemory(entryDir).catch(() => false) === true
+  }
   // The status half of the decision is shared with the UI; the two refusals
   // below stay separate because their advice differs (purge vs restore).
   const capabilities = entryCapabilities(entry, {
     hasLogFiles: holdsLog === true && !logUnrecoverable,
     hasMemoryFiles: holdsMemory,
     payloadRecoverable: logUnrecoverable ? false : null,
+    strandedMemory,
   })
   if (holdsMemory || !capabilities.canDiscard) {
-    // The exit for the all-refused state: a log whose header cannot be read can
-    // never be restored, and its memory bundle therefore cannot be restored
-    // either. Refusing `force` outside exactly that combination keeps this from
-    // becoming a generic "skip the safety check" switch.
-    const forceAllowed = force === true && logUnrecoverable === true
+    // The exit for the all-refused states: a log whose header cannot be read,
+    // or memory files whose bundle was never written. Both can never be
+    // restored, so the only remaining action is a confirmed discard. Refusing
+    // `force` anywhere else keeps this from becoming a generic skip switch.
+    const forceAllowed = force === true && (logUnrecoverable === true || strandedMemory === true)
     if (!forceAllowed) {
       const which = holdsMemory ? 'memory files' : 'payload'
       throw new DeleteError('E_TRASH_CONFLICT', `This incomplete entry still holds ${which}; restore or purge it instead of discarding it.`, {

package/lib/core/memory/json-index-adapter.js

@@ -477,6 +477,31 @@ export function createJsonIndexMemoryAdapter(options) {
             // copy of it, and the restored index no longer points at it.
             // Removing the bundle here would destroy memory content outright,
             // so keep it and leave a marker explaining the leftover.
+            // Keep the content AND its recoverability. `bundle.json` is written
+            // only after every file moved, so a failure inside the move loop
+            // used to leave `files/` with no manifest: `readExported` saw
+            // nothing, restore refused, discard refused the files it found, and
+            // the entry could never be cleaned up. Write a rescue bundle for the
+            // files that are still here.
+            const strandedEntries = []
+            for (const moved of failedMoves) {
+              const name = basename(moved.to)
+              const original = bundle.entries.find((item) => item.storedFile === name)
+              if (original !== undefined) strandedEntries.push(original)
+            }
+            if (strandedEntries.length > 0) {
+              const rescue = {
+                ...bundle,
+                bundlePath: join(bundleDir, bundleFileName),
+                count: strandedEntries.length,
+                entries: strandedEntries,
+                links: [],
+                rescuedAt: now(),
+              }
+              await fsApi
+                .writeFile(join(bundleDir, bundleFileName), `${JSON.stringify(rescue, null, 2)}\n`, 'utf8')
+                .catch(() => {})
+            }
             await fsApi
               .writeFile(
                 join(bundleDir, ORPHAN_MARKER),
@@ -534,6 +559,22 @@ export function createJsonIndexMemoryAdapter(options) {
               alreadyRestored.add(entry.nodeId)
               continue
             }
+            // The index still lists the node (a failed export restored the
+            // pristine snapshot) while its content file is only in the bundle.
+            // Putting the file back finishes the job; refusing here left the
+            // entry with no usable action at all.
+            if (destination !== null && isPlainFileName(entry.storedFile) && typeof bundle.bundlePath === 'string') {
+              const stored = join(dirname(bundle.bundlePath), 'files', entry.storedFile)
+              try {
+                await fsApi.mkdir(dirname(destination), { recursive: true })
+                await fsApi.rename(stored, destination)
+                alreadyRestored.add(entry.nodeId)
+                continue
+              } catch {
+                // Fall through to the refusal: the content is neither in place
+                // nor where the bundle says it is.
+              }
+            }
             throw new DeleteError('E_TRASH_CONFLICT', 'A memory entry with the same id already exists; restore aborted.', {
               adapter: id,
               nodeId: entry.nodeId,

package/lib/host/api.js

@@ -41,6 +41,16 @@
 import { randomBytes } from 'node:crypto'
 import { mkdir, readdir, stat } from 'node:fs/promises'
 import { join } from 'node:path'
+
+/** True when the path exists (any type). Used by the stranded-memory probe. */
+async function exists(target) {
+  try {
+    await stat(target)
+    return true
+  } catch {
+    return false
+  }
+}
 import { DeleteError, ERROR_STATUS, asDeleteError, toWireError } from '../core/errors.js'
 import { redactDetails } from '../core/redact.js'
 import { createAuditLog } from '../core/audit.js'
@@ -440,13 +450,51 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       if (typeof entry?.sessionId !== 'string' || !SESSION_ID_PATTERN.test(entry.sessionId)) return null
       if (typeof entry?.trashId !== 'string' || !isTrashId(entry.trashId)) return null
       const sessionDir = join(trash.entryDir(entry.trashId), 'session')
-      if (!(await readdir(sessionDir).catch(() => null))) return null
+      let names
+      try {
+        names = await readdir(sessionDir)
+      } catch (error) {
+        // "No session directory" is a definitive answer; a lock or a permission
+        // error is not. Only the first one may be reported as unrecoverable.
+        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null
+        throw error
+      }
+      if (!Array.isArray(names) || names.length === 0) return null
       const cwd = await readSessionLogCwd(sessionDir)
       if (cwd === null) return null
       const from = join(paths.sessionsRoot, projectKey(cwd), encodeSessionSegment(entry.sessionId))
       if (!isPathInside(paths.sessionsRoot, from) || !isPathInside(paths.trashDir, sessionDir)) return null
       return { sessionId: entry.sessionId, from, to: sessionDir }
     },
+    /**
+     * Files under `<entry>/memory/<adapter>/` with no readable `bundle.json`.
+     *
+     * Such an adapter can never be restored: `readExported` only speaks bundle
+     * files, and discard refuses to delete files it cannot account for. This is
+     * what lets the panel offer the one remaining exit instead of a dead row.
+     */
+    hasStrandedMemory: async (entryDir) => {
+      const root = join(entryDir, 'memory')
+      let dirents
+      try {
+        dirents = await readdir(root, { withFileTypes: true })
+      } catch {
+        return false
+      }
+      for (const dirent of dirents) {
+        if (!dirent.isDirectory()) continue
+        const bundle = join(root, dirent.name, 'bundle.json')
+        if (await exists(bundle)) continue
+        let files = []
+        try {
+          files = await readdir(join(root, dirent.name, 'files'), { recursive: true })
+        } catch {
+          files = []
+        }
+        if (files.length > 0 || await exists(join(root, dirent.name, 'ORPHANED.json'))) return true
+      }
+      return false
+    },
     // Manifest paths are data, not truth: a hand-edited manifest must not turn
     // "restore" into a proxy for stat/move on arbitrary directories.
     isInsideSessionsRoot: (target) => typeof target === 'string' && target !== '' && isPathInside(paths.sessionsRoot, target),
@@ -1085,10 +1133,25 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // must say so instead of advertising a restore that always fails.
     let payloadRecoverable = null
     if (hasLogFiles === true && entry !== null && (entry.sessionLog === null || entry.sessionLog === undefined)) {
-      const rebuilt = await ops.recoverSessionLog(entry).catch(() => null)
-      payloadRecoverable = rebuilt !== null
+      try {
+        const rebuilt = await ops.recoverSessionLog(entry)
+        payloadRecoverable = rebuilt !== null
+      } catch (error) {
+        // A locked file is not an unreadable one: EACCES/EBUSY means "ask again
+        // later". Report the payload as UNKNOWN so the panel keeps offering
+        // restore instead of advertising a forced discard that would delete
+        // memory the user could still get back.
+        logger.warn?.(`[conversation-recycle-bin] could not read the log of ${trashId} right now: ${error?.message ?? error}`)
+        payloadRecoverable = null
+      }
+    }
+    // Files under `memory/` with no readable bundle cannot be restored by
+    // anything: the entry needs an explicit, phrase-confirmed exit for them.
+    let strandedMemory = null
+    if (hasMemoryFiles === true && entry !== null && entry.status !== 'trashed') {
+      strandedMemory = await ops.hasStrandedMemory(dir).catch(() => null)
     }
-    return { hasLogFiles, hasMemoryFiles, payloadRecoverable }
+    return { hasLogFiles, hasMemoryFiles, payloadRecoverable, strandedMemory }
   }
 
   async function serializeEntry(entry) {

package/lib/host/paths.js

@@ -176,12 +176,18 @@ async function readZstdFirstLine(file) {
  * directory has no readable log. Used only to reconstruct the original path of
  * a log a crashed hard delete already moved into the recycle bin.
  */
+/** Error codes that mean "ask again later", never "this will never work". */
+const TRANSIENT_FS_CODES = new Set(['EACCES', 'EPERM', 'EBUSY', 'EMFILE', 'ENFILE', 'EAGAIN'])
+
 export async function readSessionLogCwd(sessionDir) {
   let names = []
   try {
     names = (await readdir(sessionDir)).filter((name) => /\.jsonl(?:\.zstd)?$/u.test(name))
-  } catch {
-    return null
+  } catch (error) {
+    // Only "not there" is a definitive answer. A locked or forbidden directory
+    // says nothing about the header, so it must not become "unrecoverable".
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null
+    throw error
   }
   const ranked = names.sort((left, right) => {
     const rank = (name) => (name.includes('v4') ? 0 : name.endsWith('.zstd') ? 1 : 2)
@@ -195,8 +201,10 @@ export async function readSessionLogCwd(sessionDir) {
       if (parsed !== null && typeof parsed === 'object' && typeof parsed.cwd === 'string' && parsed.cwd !== '') {
         return parsed.cwd
       }
-    } catch {
-      // Try the next generation/log file.
+    } catch (error) {
+      // A corrupt header is worth skipping; a transient lock is not, because
+      // the caller would report the log as permanently unreadable.
+      if (TRANSIENT_FS_CODES.has(error?.code) || TRANSIENT_FS_CODES.has(error?.cause?.code)) throw error
     }
   }
   return null

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.18'
+export const PLUGIN_VERSION = '0.3.19'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",

package/test/api.test.mjs

@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import test from 'node:test'
 import { normalizeConfig } from '../lib/core/config.js'
 import { createFileLock } from '../lib/core/file-lock.js'
-import { createDeleteApi, QUEUE_GRACE_MS, ROUTE_PREFIX, TRASH_LOCK_BUDGET_MS } from '../lib/host/api.js'
+import { createDeleteApi, QUEUE_GRACE_MS, ROUTE_PREFIX, TRASH_LOCK_BUDGET_MS, requestOriginVerdict } from '../lib/host/api.js'
 import { createSessionLogOps } from '../lib/host/catalog.js'
 import { createSessionGateway } from '../lib/host/gateway.js'
 import { createLifecycleOps } from '../lib/host/lifecycle.js'
@@ -1999,3 +1999,74 @@ test('gateway: an unavailable session list degrades to empty instead of failing
     await home.cleanup()
   }
 })
+
+// The origin fence compares the authority literally. A proxy (or a shell) that
+// rewrites `Host` to 127.0.0.1 while the page keeps `localhost` — or drops the
+// header entirely — yields a 403 the user cannot explain, so the exact matrix
+// is pinned here.
+test('origin fence: loopback spellings, the desktop shell and a missing Host', () => {
+  const verdict = (headers) => requestOriginVerdict(headers, { requireSameOrigin: true, allowNonLoopback: false, allowedHosts: [] })
+  const ok = [
+    { host: '127.0.0.1:1067', origin: 'http://127.0.0.1:1067' },
+    { host: 'localhost:1067', origin: 'http://localhost:1067' },
+    { host: '127.0.0.1:1067', origin: 'dsh-app://app' },
+    { host: '127.0.0.1:1067' },
+  ]
+  for (const headers of ok) assert.equal(verdict(headers).ok, true, JSON.stringify(headers))
+  const refused = [
+    [{ host: '127.0.0.1:1067', origin: 'http://localhost:1067' }, 'E_FORBIDDEN_ORIGIN'],
+    [{ host: 'localhost:1067', origin: 'http://127.0.0.1:1067' }, 'E_FORBIDDEN_ORIGIN'],
+    [{ host: '127.0.0.1:1067', origin: 'http://127.0.0.1:1068' }, 'E_FORBIDDEN_ORIGIN'],
+    [{ host: '127.0.0.1:1067', 'sec-fetch-site': 'cross-site', origin: 'http://127.0.0.1:1067' }, 'E_FORBIDDEN_ORIGIN'],
+    [{ origin: 'http://127.0.0.1:1067' }, 'E_FORBIDDEN_HOST'],
+  ]
+  for (const [headers, code] of refused) {
+    const result = verdict(headers)
+    assert.equal(result.ok, false, JSON.stringify(headers))
+    assert.equal(result.error.code, code, JSON.stringify(headers))
+  }
+})
+
+// Memory files whose bundle was never written are unrecoverable: the list must
+// say so, and the discard route must accept the forced (phrase-confirmed) exit
+// that the panel then offers.
+test('trash: stranded memory files offer, and accept, the forced discard', async () => {
+  const fixture = await makeFixture()
+  try {
+    const trashId = `strand-${Date.now().toString(36)}`
+    const entryDir = join(fixture.paths.trashDir, trashId)
+    await mkdir(join(entryDir, 'memory', 'md', 'files'), { recursive: true })
+    await writeFile(join(entryDir, 'memory', 'md', 'files', 'n1.content'), 'body', 'utf8')
+    await writeFile(join(entryDir, 'memory', 'md', 'ORPHANED.json'), '{"format":1}', 'utf8')
+    await writeFile(join(entryDir, 'manifest.json'), JSON.stringify({
+      format: 1,
+      trashId,
+      sessionId: S1,
+      title: 'stranded memory',
+      mode: 'hard',
+      includeMemory: true,
+      deletedAt: Date.now(),
+      createdAt: Date.now(),
+      status: 'failed',
+      sessionLog: null,
+      catalog: null,
+      memory: { adapters: [], total: 0 },
+    }), 'utf8')
+
+    const listed = await call(fixture.api, '/trash', { method: 'GET' })
+    const row = [...(listed.body.trash ?? []), ...(listed.body.incomplete ?? [])].find((item) => item.trashId === trashId)
+    assert.ok(row !== undefined, 'the entry must be listed')
+    assert.equal(row.capabilities.strandedMemory, true)
+    assert.equal(row.capabilities.canForceDiscard, true)
+
+    const withoutForce = await call(fixture.api, '/trash/discard', { body: { trashId, confirmPhrase: 'DELETE' } })
+    assert.equal(withoutForce.status, 409)
+    assert.equal(await pathExists(entryDir), true)
+
+    const forced = await call(fixture.api, '/trash/discard', { body: { trashId, confirmPhrase: 'delete', force: true } })
+    assert.equal(forced.status, 200)
+    assert.equal(await pathExists(entryDir), false)
+  } finally {
+    await fixture.home.cleanup()
+  }
+})

package/test/cascade.test.mjs

@@ -439,7 +439,7 @@ test('capabilities: an incomplete entry with no payload cannot be restored and c
     { status: 'failed', sessionLog: null, catalog: null, memory: { adapters: [], total: 0 } },
     { hasLogFiles: false, hasMemoryFiles: false, requirePayload: true },
   )
-  assert.deepEqual(caps, { status: 'failed', canRestore: false, canPurge: false, canDiscard: true, canForceDiscard: false })
+  assert.deepEqual(caps, { status: 'failed', canRestore: false, canPurge: false, canDiscard: true, canForceDiscard: false, strandedMemory: false })
 })
 
 test('capabilities: a payload on disk makes restore possible and blocks discard', () => {
@@ -701,3 +701,128 @@ test('restore: a completed restore records its terminal state before the audit w
   assert.equal(stored.status, 'restored')
   assert.equal(stored.restoredAt, 7_000)
 })
+
+// Memory files with no readable bundle cannot be restored by anything, so the
+// entry must expose the forced, phrase-confirmed exit instead of three dead
+// buttons (the stranded state that used to have no way out at all).
+test('capabilities: stranded memory files open the forced-discard exit', () => {
+  const base = { status: 'failed', sessionLog: null, catalog: null, memory: { total: 0 } }
+  const stranded = entryCapabilities(base, { hasLogFiles: false, hasMemoryFiles: true, strandedMemory: true, requirePayload: true })
+  assert.equal(stranded.canForceDiscard, true)
+  assert.equal(stranded.strandedMemory, true)
+  assert.equal(stranded.canDiscard, false, 'plain discard still refuses files it cannot account for')
+
+  const healthy = entryCapabilities(base, { hasLogFiles: false, hasMemoryFiles: true, strandedMemory: false, requirePayload: true })
+  assert.equal(healthy.canForceDiscard, false, 'a readable bundle must not offer the destructive exit')
+})
+
+test('discard: force is accepted for stranded memory and still refused without it', async () => {
+  const home = await makeTempHome('stranded-')
+  try {
+    const trashId = 't5-strand'
+    const entryDir = join(home.root, 'trash', trashId)
+    await mkdir(join(entryDir, 'memory', 'md', 'files'), { recursive: true })
+    await writeFile(join(entryDir, 'memory', 'md', 'files', 'x.content'), 'body', 'utf8')
+    const entry = {
+      format: 1, trashId, sessionId: 'session-abc12345', title: 'stranded',
+      mode: 'hard', includeMemory: true, status: 'failed', sessionLog: null, catalog: null,
+      memory: { adapters: [], total: 0 },
+    }
+    const captured = new Map([[trashId, entry]])
+    const trash = {
+      async read(id) { return captured.get(id) ?? null },
+      entryDir(id) { return join(home.root, 'trash', id) },
+      async remove(id) { captured.delete(id) },
+      async update(id, patch) { Object.assign(captured.get(id), patch) },
+      async allocate() { throw new Error('not used') },
+      async write() { throw new Error('not used') },
+      async list() { return [...captured.values()] },
+    }
+    const ops = {
+      memory: { restoreEntry: async () => {} },
+      sessionLog: { restoreEntry: async () => {} },
+      catalog: { restore: async () => async () => {} },
+      session: { inspect: async () => null },
+      lifecycle: { quiesce: async () => async () => {} },
+      pathExists: async (target) => stat(target).then(() => true, () => false),
+      hasFiles: async (target) => (await readdir(target).catch(() => [])).length > 0,
+      hasStrandedMemory: async (dir) => {
+        const names = await readdir(join(dir, 'memory'), { withFileTypes: true }).catch(() => [])
+        for (const dirent of names) {
+          if (!dirent.isDirectory()) continue
+          if (await stat(join(dir, 'memory', dirent.name, 'bundle.json')).then(() => true, () => false)) continue
+          const files = await readdir(join(dir, 'memory', dirent.name, 'files'), { recursive: true }).catch(() => [])
+          if (files.length > 0) return true
+        }
+        return false
+      },
+      recoverSessionLog: async () => null,
+      isInsideSessionsRoot: () => true,
+      isInsideTrashDir: () => true,
+    }
+
+    // Without force: refused, and the refusal says it is forceable.
+    await assert.rejects(
+      performDiscard({ entry, ops, trash, audit: makeAudit() }),
+      (error) => error.code === 'E_TRASH_CONFLICT' && error.details?.forceable === true,
+    )
+    assert.equal(captured.has(trashId), true, 'a refused discard must not delete anything')
+
+    // With force (the phrase is checked by the route): accepted.
+    await performDiscard({ entry, ops, trash, audit: makeAudit(), force: true })
+    assert.equal(captured.has(trashId), false)
+  } finally {
+    await home.cleanup()
+  }
+})
+
+// A locked log is not an unreadable one: the entry must keep its restore path
+// instead of advertising a discard that deletes the memory bundle.
+test('restore: a transient log read failure asks to retry instead of declaring the log lost', async () => {
+  const home = await makeTempHome('transient-')
+  try {
+    const trashId = 't6-transient'
+    const entryDir = join(home.root, 'trash', trashId)
+    await mkdir(join(entryDir, 'session'), { recursive: true })
+    await writeFile(join(entryDir, 'session', 'session.jsonl'), '{"cwd":"/x"}\n', 'utf8')
+    const entry = {
+      format: 1, trashId, sessionId: 'session-abc12345', title: 'locked',
+      mode: 'hard', includeMemory: false, status: 'pending', sessionLog: null, catalog: null,
+      memory: { adapters: [], total: 0 },
+    }
+    const trash = {
+      async read() { return entry },
+      entryDir() { return entryDir },
+      async remove() {},
+      async update() {},
+      async allocate() { throw new Error('not used') },
+      async write() { throw new Error('not used') },
+      async list() { return [entry] },
+    }
+    const locked = Object.assign(new Error('EBUSY: resource busy or locked'), { code: 'EBUSY' })
+    const ops = {
+      memory: { restoreEntry: async () => {} },
+      sessionLog: { restoreEntry: async () => {} },
+      catalog: { restore: async () => async () => {} },
+      session: { inspect: async () => null },
+      lifecycle: { quiesce: async () => async () => {} },
+      pathExists: async (target) => stat(target).then(() => true, () => false),
+      hasFiles: async () => false,
+      hasStrandedMemory: async () => false,
+      recoverSessionLog: async () => { throw locked },
+      isInsideSessionsRoot: () => true,
+      isInsideTrashDir: () => true,
+    }
+    await assert.rejects(
+      performRestore({ entry, ops, trash, audit: makeAudit() }),
+      (error) => error.code === 'E_TRASH_CONFLICT' && error.details?.reason === 'log-read-transient',
+    )
+    // Discard must not treat that same transient error as "permanently lost".
+    await assert.rejects(
+      performDiscard({ entry, ops, trash, audit: makeAudit(), force: true }),
+      (error) => error.code === 'E_TRASH_CONFLICT' && error.details?.forceable !== true,
+    )
+  } finally {
+    await home.cleanup()
+  }
+})

package/test/client-module.test.mjs

@@ -1030,3 +1030,73 @@ test('client: every error code the Host can emit has a message in both locales',
     }
   }
 })
+
+// A restored entry that still holds memory files used to render no action at
+// all: the Host allows purge, the panel only knew about restore and discard.
+test('client module: an incomplete entry offers purge when the Host allows it', async () => {
+  const { exported } = await loadClient()
+  const IncompleteEntries = exported.__components.IncompleteEntries
+  const flatten = (node, out = []) => {
+    if (node === null || node === undefined || node === false || typeof node !== 'object') return out
+    if (Array.isArray(node)) {
+      for (const child of node) flatten(child, out)
+      return out
+    }
+    out.push(node)
+    flatten(node.children, out)
+    return out
+  }
+  const entry = {
+    trashId: 't9-restored',
+    sessionId: 'session-abc12345',
+    title: 'restored but holding memory',
+    status: 'restored',
+    updatedAt: 1,
+    memory: 0,
+    capabilities: { canRestore: false, canPurge: true, canDiscard: false, canForceDiscard: false },
+  }
+  const tree = IncompleteEntries({
+    entries: [entry],
+    discardTarget: null,
+    discardPhrase: '',
+    onPhrase: () => {},
+    onStart: () => {},
+    onCancel: () => {},
+    onDiscard: () => {},
+    onRestore: () => {},
+    restoreBusyId: null,
+    discardBusyId: null,
+    purgeTarget: null,
+    purgePhrase: '',
+    onPurgePhrase: () => {},
+    onPurgeStart: () => {},
+    onPurgeCancel: () => {},
+    onPurge: () => {},
+    purgeBusyId: null,
+  })
+  // The row has no restore (capability says no) and no plain discard (memory
+  // occupies it), so the ONLY action left is the purge this test is about.
+  const buttons = flatten(tree).filter((node) => typeof node?.type === 'function')
+  assert.equal(buttons.length, 1, 'exactly the purge action should be rendered')
+
+  // Without the capability the destructive action must stay hidden.
+  const withoutPurge = IncompleteEntries({
+    entries: [{ ...entry, capabilities: { canRestore: false, canPurge: false, canDiscard: false, canForceDiscard: false } }],
+    discardTarget: null, discardPhrase: '', onPhrase: () => {}, onStart: () => {}, onCancel: () => {},
+    onDiscard: () => {}, onRestore: () => {}, restoreBusyId: null, discardBusyId: null,
+    purgeTarget: null, purgePhrase: '', onPurgePhrase: () => {}, onPurgeStart: () => {},
+    onPurgeCancel: () => {}, onPurge: () => {}, purgeBusyId: null,
+  })
+  const noButtons = flatten(withoutPurge).filter((node) => typeof node?.type === 'function')
+  assert.equal(noButtons.length, 0, 'without canPurge the panel must not offer a destructive action')
+})
+
+test('client module: the background-sweep notice carries how long ago it ran', async () => {
+  const { exported } = await loadClient()
+  const now = Date.now()
+  assert.equal(exported.__formatAgo(now - 5_000, now), '刚刚')
+  assert.match(exported.__formatAgo(now - 30 * 60_000, now), /分钟前|min ago/)
+  assert.match(exported.__formatAgo(now - 3 * 3_600_000, now), /小时前|h ago/)
+  assert.match(exported.__formatAgo(now - 2 * 86_400_000, now), /天前|d ago/)
+  assert.equal(exported.__formatAgo(undefined, now), '')
+})

package/test/memory.test.mjs

@@ -574,3 +574,63 @@ test('restoreEntry: a memory bundle outside the recycle bin is refused before an
     await store.cleanup()
   }
 })
+
+// Export dies before `bundle.json` exists and the content cannot be moved back
+// either. The content is then the only copy and there is no bundle to restore
+// it from — so the adapter must leave a usable one, otherwise the entry can be
+// neither restored nor cleaned up.
+test('memory adapter: a failed export leaves a restorable rescue bundle', async () => {
+  const root = join(process.cwd(), 'test', '.tmp', `md-rescue-${Date.now()}`)
+  const store = join(root, 'store')
+  const trashDir = join(root, 'trash', 'entry-1')
+  try {
+    await mkdir(join(store, 'content'), { recursive: true })
+    await writeFile(join(store, 'content', 'a.md'), 'body-a', 'utf8')
+    await writeFile(join(store, '_index.json'), JSON.stringify({
+      schema: 2,
+      nodes: { n1: { session: SESSION_1, path: 'content/a.md' } },
+    }), 'utf8')
+
+    const realFs = await import('node:fs/promises')
+    let bundleWriteAttempts = 0
+    let moveBackBlocked = true
+    const fsApi = {
+      ...realFs,
+      async writeFile(file, data, encoding) {
+        if (String(file).endsWith('bundle.json')) {
+          bundleWriteAttempts += 1
+          // Only the export's own bundle write fails; the rescue one succeeds.
+          if (bundleWriteAttempts === 1) throw Object.assign(new Error('EPERM: not permitted'), { code: 'EPERM' })
+        }
+        return realFs.writeFile(file, data, encoding)
+      },
+      async rename(from, to) {
+        // Only the compensation's move-back fails (a backup holding the file);
+        // the later restore must be able to move it back for real.
+        if (moveBackBlocked && String(from).includes('files') && !String(to).includes('files')) {
+          moveBackBlocked = false
+          throw Object.assign(new Error('EBUSY: locked by a backup'), { code: 'EBUSY' })
+        }
+        return realFs.rename(from, to)
+      },
+    }
+
+    const adapter = createJsonIndexMemoryAdapter({
+      id: 'probe', label: 'probe', indexFile: join(store, '_index.json'),
+      rootDir: store, sessionField: 'session', nodesPointer: '/nodes', fsApi,
+    })
+    await assert.rejects(adapter.exportSession(SESSION_1, trashDir), (error) => error.code === 'E_MEMORY_FAILED')
+
+    // The rescue bundle exists and describes the file that stayed behind.
+    const rescue = JSON.parse(await readFile(join(trashDir, 'memory', 'probe', 'bundle.json'), 'utf8'))
+    assert.equal(rescue.entries.length, 1)
+    assert.equal(rescue.entries[0].nodeId, 'n1')
+    assert.equal(rescue.entries[0].storedFile, 'n1.content')
+
+    // A normal restore consumes it: the content file goes back to the store.
+    await adapter.restoreBundle(rescue)
+    assert.equal(await readFile(join(store, 'content', 'a.md'), 'utf8'), 'body-a')
+  } finally {
+    await rm(root, { recursive: true, force: true, maxRetries: 8, retryDelay: 60 }).catch(() => {})
+  }
+})