dsh-conversation-recycle-bin 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -3,6 +3,52 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.4] — 2026-10-20
+
+对应 `AUDIT-2026-10-20-last3-versions.md` 的四条非阻塞隐患 N1–N4，以及测试驱动下新发现的 P3 回归 N5。
+
+### Fixed
+
+- **N1：批量删除中途限流会静默丢尾项**：`deletePlan` 循环里 `!reservation.ok` 分支的 `break` 改为 `continue`。0.3.3 之前当第二 Host 在 preflight 与 take 之间抢走额度、或 `sessions.length > limiter.remaining`（跨进程 / 时间窗滑动）时，第一条被拒之后的所有 session 既不进 `results` 也不进 `failures`——一次 50 项批量 + 20/min 上限下，第 22–50 项从 UI 反馈里凭空消失。`continue` 让每一项各得一条 `E_RATE_LIMITED` 记录；首个项目预算不足直接抛 429 的既有契约不变。新增 `test/api.test.mjs` 用例：monkey-patch limiter 让 take 从第二次起即失败，断言 3 项批量 → 1 结果 + 2 失败。
+- **N2：审计 `tail()` 字节窗口对齐到 `\n` 时丢一条完整记录**：`start > 0` 分支不再无条件 `rawLines.slice(1)`——先读 `start-1` 一字节，`\n` 意味着窗口从行首开始，`rawLines[0]` 是完整 JSON 保留；否则才丢。同时 `CHUNK` 抽为 `createAuditLog({ tailWindowBytes })` 便于回归。新增 `test/trash-audit.test.mjs` 用例：对齐窗口断言三条完整记录全在，偏移 1 字节窗口断言撕裂片段被正确丢弃。
+- **N5（连带发现）：`tail()` 从未真正做窗口读**：Node `fs.readFile(path, {encoding,flag,signal})` 不接受 `start/end`，0.3.3 P3「只读尾部 256KB」的实现其实每次仍全量读盘。改用 `fsApi.open(filePath, 'r')` + `FileHandle.read(buffer, offset, length, position)` 的位置化读，`stat` 也走 handle；`fsApi` 类型签名加 `open`。修复后 5MB 审计文件 tail 只吃 256KB 内存，与 P3 原意一致。
+- **N3：HTTP 反馈通道对自定义鉴权头也强加 `Bearer ` 前缀**：`deliverHttp` 现只在 `authHeader === 'Authorization'` 时前缀 `Bearer `（RFC 7235 语法的合法要求），其它如 `X-Api-Key` / `x-goog-api-key` 直接发送裸 token——多数非 `Authorization` 中转拒绝 Bearer 前缀，此前配任何自定义头都会 401。默认 `Authorization` 通道逐字节不变。新增 `test/feedback.test.mjs` 双 case 用例（Bearer vs 裸 token）。
+- **N4：`visitorAsFrom: true` 的 UI 提示未说明与常见发信方冲突**：`feedback.emailHintAsFrom` 词条中英各扩写为完整句子，说明「QQ / 163 / Gmail 一类要求 From 与登录账号一致会拒收，仅允许任意 From 的中继才生效」。行为不变、配置不变。
+
+### Changed / Maintenance
+
+- 回归测试：`api` 38 → 39、`feedback` 18 → 19、`trash-audit` 3 → 4；总 128 → **131 全绿**。
+
+## [0.3.3] — 2026-10-19
+
+本次修复对应 `AUDIT-2026-10-19-review.md` 的 S1–S3、P1–P5、R1–R4 与 M 项；每条均带回归测试。
+
+### Security
+
+- **S1：`Host` 头不带端口时同源端口比较被恒真绕过**：`requestPort === ''` 时旧表达式退化为 `originPort === originPort`，任意端口的 Origin 都通过。现在缺失端口按 Origin 自身 scheme 的默认端口归一（http→80、https→443），`Host: 127.0.0.1` + `Origin: http://127.0.0.1:9999` 被拒为 `403 E_FORBIDDEN_ORIGIN`，而 `http://127.0.0.1`（无端口）仍放行。
+
+### Fixed
+
+- **S2：未知 GET 路由误报 405**：路径不存在时 GET/POST 统一返回 `404 E_NOT_FOUND`，405 只保留给「路径存在但方法错误」。
+- **S3：损坏/缺失 manifest 的回收站目录永久隐身**：新增 `trash.scanUnreadable()`（missing / corrupt / unreadable 三类），`/trash` 把它们列为 `status: 'unreadable'` 的 incomplete 项；`discard` 对目录存在但清单不可读的条目走 `performDiscard` 的磁盘检查——空目录可强制清理，仍持有 `session/` 日志或记忆文件则拒绝（`409 E_TRASH_CONFLICT`），不再只能手动删盘。
+- **P1：live drain 轮询每轮全量重建会话列表**：`inspectRunning` 先走新增的 `gateway.isRunning(sessionId)` 内存存活表探针（`running/active/busy` 布尔），探针答不出才回退全量 `inspect()`，批量删除多个 live 会话时不再线性放大 `controller.list()` 与工作区扫描。
+- **P2：`/trash` 每次全量读盘解析 manifest**：加 1.5s TTL 缓存，delete/restore/purge/discard 成功后主动失效。
+- **P3：`/audit` 全量读 5MB 再解析**：`tail()` 只读尾部 256KB 块、丢弃首条残行，malformed 只统计窗口内。
+- **P4：跨进程锁等待 30s 短于批量最坏耗时**：`/delete` 锁预算按 `min(900s, 15s + 16s×批量数 + 每 live 会话的 drain 窗口)` 估算，大批量不再被第二个 Host 误判 `E_LOCK_BUSY`。
+- **P5：全部 blocked 时仍做全量记忆计数**：`blocked.length > 0` 时跳过 `countForSessions`，返回 `{total:0, skipped:true}` 形状。
+- **R1：请求体超限后继续读完整个 body**：超限立即 `finish(413)`，慢速超大请求不再占着连接。
+- **R2：反馈投递失败也扣每小时额度**：`takeSlot` 返回 `release()`，传输失败 catch 里先退还槽位再抛 `E_FEEDBACK_TRANSPORT`；成功投递才计数，SMTP/HTTP 临时故障不会把用户锁一小时。
+- **R3：批量列表按 soft 固定裁决，与 `defaultMode` 脱节**：`/sessions` 每行裁决改用 `config.defaultMode`；`stopLiveSessions:false` + hard 默认时，不可删的 live 行直接标 `deletable:false`。
+- **R4：失败的删除项也占每分钟额度**：`limiter.take(1)` 改为带 `release()` 的预留，单条失败在 catch 里退还槽位，只有真正成功的删除计入窗口；首个 item 预算不足直接抛 429 的既有契约不变。
+
+### Changed / Maintenance
+
+- **M2：会话 ID 正则去重**：抽出 `lib/core/ids.js` 的 `SESSION_ID_PATTERN`，`api.js` / `gateway.js` 共享，删除两处本地副本。
+- **M4：`/state` 不再外泄记忆适配器绝对路径**：只输出 `{id,label,available,reason}`，`storePath` 不离开 Host。
+- **M1：删除无引用的死 CSS `.dc-mode-preferred`**。
+- **M3：`npm run check` 改为 `scripts/check-syntax.mjs` 遍历 `lib/**/*.js` + `client.js` 逐个 `node --check`**（原链式清单只覆盖 3 个文件，新增/改名模块不会再漏检）。
+- 回归测试：`feedback` 17 → 18、`core` 13 → 14、`api` 34 → 38；新增覆盖 S1 无端口 Host、S2 未知路由 404、S3 损坏清单列出/清理/冲突、R2 失败退额度、R3 默认模式裁决、R4 失败退额度。
+
 ## [0.3.2] — 2026-10-18
 
 ### Fixed

package/README.md

@@ -190,7 +190,7 @@ dsh-conversation-recycle-bin/
 │     ├─ memory.js               # 适配器装配
 │     ├─ feedback.js             # 反馈校验/渲染/投递（http 或 smtp，凭证只读环境变量）
 │     └─ api.js                 # 同源 HTTP API、确认 token、限流
-└─ test/                        # 122 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
+└─ test/                        # 131 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
 ```
 
 ---
@@ -199,7 +199,7 @@ dsh-conversation-recycle-bin/
 
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
-npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（122 个用例）
+npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（131 个用例）
 npm run check   # 语法 + manifest
 ```
 
@@ -258,8 +258,8 @@ npm run check   # 语法 + manifest
 | `DSH_CRB_FEEDBACK_TO` | 收件人（优先于 `feedback.to`） |
 | `DSH_CRB_FEEDBACK_FROM` | 发件人（优先于 `feedback.from`） |
 | `DSH_CRB_MAIL_API_URL` | 邮件 HTTP API 地址（Resend 兼容形状，也可指向自建转发网关） |
-| `DSH_CRB_MAIL_API_TOKEN` | 该 API 的 Bearer token |
-| `DSH_CRB_MAIL_API_AUTH_HEADER` | 可选，鉴权头名，默认 `authorization`，值为 `Bearer <token>` |
+| `DSH_CRB_MAIL_API_TOKEN` | 该 API 的鉴权 token |
+| `DSH_CRB_MAIL_API_AUTH_HEADER` | 可选，鉴权头名，默认 `authorization`；`authorization` 时值形如 `Bearer <token>`（RFC 7235），其它自定义头（如 `x-api-key`）直接发送裸 token |
 | `DSH_CRB_SMTP_URL` | SMTP 连接串，如 `smtps://user:pass@smtp.example.com:465` |
 
 HTTP 通道发出的 JSON 固定为 `{from, to: [收件人], subject, text, reply_to}`，`text` 是纯文本（不生成 HTML）；`reply_to` 取自表单里访客填写的邮箱（留空则不填）。SMTP 通道按需 `import('nodemailer')`：它已声明为 `optionalDependencies`（`^10.1.2`），正常安装会随包就位；以 `link:` 方式开发安装时插件从自身真实目录解析，需在**本仓库**跑一次 `npm install`。仍未安装时返回 `E_FEEDBACK_TRANSPORT` + `reason: nodemailer-missing`。
@@ -287,8 +287,8 @@ node -e "console.log('b64:' + Buffer.from('your-feedback@example.com','utf8').to
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
 npm run check                      # 语法 + manifest（含 feedback.js）
-node test/feedback.test.mjs        # 17 个反馈用例
-npm test                           # 全量 122 个用例
+node test/feedback.test.mjs        # 19 个反馈用例
+npm test                           # 全量 131 个用例
 
 # 端到端：用本机收件桩观察真实投递路径，不外发邮件
 $env:DSH_CRB_MAIL_API_URL   = 'http://127.0.0.1:9099/emails'

package/client.js

@@ -127,6 +127,7 @@ window.__ModuleLoader__.load({
         'trash.status.restoring': 'restoring',
         'trash.status.purging': 'purging',
         'trash.status.restored': 'restored',
+        'trash.status.unreadable': 'unreadable manifest',
         'batch.title': 'Batch deletion',
         'batch.hint': 'Each conversation is its own transaction; a failure rolls only that conversation back.',
         'batch.selected': '{count} selected',
@@ -164,7 +165,7 @@ window.__ModuleLoader__.load({
         'feedback.emailLabel': 'Your email (optional)',
         'feedback.emailPlaceholder': 'you@example.com',
         'feedback.emailHint': 'Used as Reply-To so the maintainer can answer you. Leave it empty to stay anonymous.',
-        'feedback.emailHintAsFrom': 'Shown as the sender (From) of the mail.',
+        'feedback.emailHintAsFrom': 'Sent as the mail\'s From address. Most relays (QQ, 163, Gmail) reject this unless the mailbox matches the login account — enable only when the relay accepts arbitrary From.',
         'feedback.contextLabel': 'Attached automatically',
         'feedback.contextHint': 'Plugin version, platform and language. Conversation content is never attached.',
         'feedback.contextVersion': 'Plugin version',
@@ -280,6 +281,7 @@ window.__ModuleLoader__.load({
         'trash.status.restoring': '恢复中断',
         'trash.status.purging': '清理中断',
         'trash.status.restored': '已恢复',
+        'trash.status.unreadable': '清单不可读',
         'batch.title': '批量删除',
         'batch.hint': '每个对话独立事务；失败时仅回滚该对话。',
         'batch.selected': '已选 {count} 个',
@@ -317,7 +319,7 @@ window.__ModuleLoader__.load({
         'feedback.emailLabel': '你的邮箱（选填）',
         'feedback.emailPlaceholder': 'you@example.com',
         'feedback.emailHint': '作为 Reply-To，便于维护者直接回复你；留空即匿名。',
-        'feedback.emailHintAsFrom': '会直接作为这封邮件的发件人。',
+        'feedback.emailHintAsFrom': '会直接作为这封邮件的发件人（From）。QQ / 163 / Gmail 一类会拒收非登录账号的 From，只有允许任意 From 的中继才生效。',
         'feedback.contextLabel': '自动附带',
         'feedback.contextHint': '插件版本、平台与语言；不会附带任何对话内容。',
         'feedback.contextVersion': '插件版本',
@@ -1447,9 +1449,10 @@ window.__ModuleLoader__.load({
         h('p', { className: 'dc-hint' }, t('trash.incompleteHint')),
         ...entries.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
           h('div', { className: 'dc-row-main' },
-            h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId),
-            h('div', { className: 'dc-hint' },
-              `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
+            h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId || entry.trashId),
+            h('div', { className: 'dc-hint' }, entry.status === 'unreadable' && entry.error?.message
+              ? `${t('trash.status.unreadable')} · ${entry.error.message}`
+              : `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
           h('div', { className: 'dc-row-actions' },
             entry.hasSessionLog === true && typeof onRestore === 'function'
               ? h(Button, {
@@ -1819,7 +1822,6 @@ window.__ModuleLoader__.load({
 .dc-meta{font-size:12px;color:var(--dsw-alias-label-secondary,#646a73);margin-bottom:10px}
 .dc-modes{display:flex;flex-direction:column;gap:8px;margin-bottom:12px}
 .dc-mode{display:flex;gap:9px;align-items:flex-start;padding:9px 10px;border:1px solid var(--dsw-alias-border-l1,#e5e6eb);border-radius:9px;cursor:pointer;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}
-.dc-mode-preferred{border-color:var(--dsw-alias-brand-primary,#4d6bfe)}
 .dc-live-warning{margin-top:10px;padding:8px 10px;border-radius:8px;font-size:12px;line-height:1.5;color:var(--dsw-alias-state-warn-label,#b26a00);background:var(--dsw-alias-state-warn-tertiary,#fff7e6)}
 .dc-mode input{margin-top:3px}
 .dc-mode-title{display:block;font-size:13px;font-weight:600}

package/lib/core/audit.js

@@ -11,7 +11,7 @@
  * actor (the local Web UI), session ids, mode, the memory checkbox, per-adapter
  * counts, and whether a failed transaction was rolled back.
  */
-import { appendFile, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { appendFile, mkdir, open, readFile, rename, stat, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path'
 
 /**
@@ -19,10 +19,11 @@ import { dirname } from 'node:path'
  * @param {string} options.filePath absolute path of the JSONL file
  * @param {number} [options.maxBytes] compact threshold
  * @param {number} [options.retentionLines] lines kept after compaction
+ * @param {number} [options.tailWindowBytes] byte window tail() reads from the end (default 256KB)
  * @param {() => number} [options.now]
- * @param {Pick<typeof import('node:fs/promises'), 'readFile'|'writeFile'|'mkdir'|'appendFile'|'rename'|'stat'>} [options.fsApi]
+ * @param {Pick<typeof import('node:fs/promises'), 'readFile'|'writeFile'|'mkdir'|'appendFile'|'rename'|'stat'|'open'>} [options.fsApi]
  */
-export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retentionLines = 5_000, now = Date.now, fsApi = { readFile, writeFile, mkdir, appendFile, rename, stat } }) {
+export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retentionLines = 5_000, tailWindowBytes = 256 * 1024, now = Date.now, fsApi = { readFile, writeFile, mkdir, appendFile, rename, stat, open } }) {
   let pending = Promise.resolve()
 
   function serialize(operation) {
@@ -75,26 +76,61 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
       })
     },
 
-    /** Read the most recent `limit` records; malformed lines are counted, not thrown. */
+    /**
+     * Read the most recent `limit` records; malformed lines are counted, not
+     * thrown. Only the tail window (default 256KB) is read and parsed: the
+     * settings page asks for the last N rows on every open, and a full
+     * up-to-5MB parse on each request scaled with the whole trail, not with
+     * `limit`. `fs.readFile` does not honour `{start,end}`, so this uses a
+     * positional `FileHandle.read`; earlier revisions silently read the whole
+     * file while appearing to window. Malformed lines outside the window are
+     * not counted (the metric describes the displayed window).
+     */
     async tail(limit = 50) {
-      let content = ''
+      const maxRecords = Math.max(1, Math.floor(limit))
+      const CHUNK = Math.max(1, Math.floor(tailWindowBytes))
+      let handle
       try {
-        content = await fsApi.readFile(filePath, 'utf8')
+        handle = await fsApi.open(filePath, 'r')
       } catch (error) {
         if (error?.code === 'ENOENT') return { records: [], malformed: 0 }
         throw error
       }
-      const lines = content.split('\n').filter((line) => line.trim() !== '')
-      const records = []
-      let malformed = 0
-      for (const line of lines) {
-        try {
-          records.push(JSON.parse(line))
-        } catch {
-          malformed += 1
+      try {
+        const statInfo = await handle.stat()
+        const size = statInfo.size
+        const start = Math.max(0, size - CHUNK)
+        const windowLength = size - start
+        const buffer = Buffer.alloc(windowLength)
+        const windowRead = await handle.read(buffer, 0, windowLength, start)
+        const text = buffer.subarray(0, windowRead.bytesRead).toString('utf8')
+        // `rawLines[0]` is only a torn fragment when the window starts
+        // *inside* a line. Read the byte at `start-1`: `\n` means the window
+        // begins on a line boundary and rawLines[0] is a complete record;
+        // unconditionally dropping it (pre-0.3.4) silently lost one valid
+        // record whenever the byte window happened to align with a newline.
+        let dropFirst = false
+        if (start > 0) {
+          const peek = Buffer.alloc(1)
+          const peekRead = await handle.read(peek, 0, 1, start - 1)
+          dropFirst = !(peekRead.bytesRead === 1 && peek[0] === 0x0a)
+        }
+        const rawLines = text.split('\n')
+        const lines = (dropFirst ? rawLines.slice(1) : rawLines)
+          .filter((line) => line.trim() !== '')
+        const records = []
+        let malformed = 0
+        for (const line of lines) {
+          try {
+            records.push(JSON.parse(line))
+          } catch {
+            malformed += 1
+          }
         }
+        return { records: records.slice(-maxRecords), malformed }
+      } finally {
+        await handle.close()
       }
-      return { records: records.slice(-limit), malformed }
     },
   }
 }

package/lib/core/file-lock.js

@@ -77,9 +77,11 @@ export function createFileLock({
 
   /**
    * Acquire the lock.
+   * @param {{ timeoutMs?: number }} [options] per-call wait budget override;
+   *   defaults to the lock's configured timeoutMs
    * @returns {Promise<() => Promise<void>>} release
    */
-  async function acquire() {
+  async function acquire({ timeoutMs: waitBudget = timeoutMs } = {}) {
     const nonce = randomBytes(8).toString('hex')
     const started = now()
     let handle = null
@@ -108,7 +110,7 @@ export function createFileLock({
           await fsApi.rm(lockPath, { force: true }).catch(() => {})
           continue
         }
-        if (now() - started >= timeoutMs) {
+        if (now() - started >= waitBudget) {
           const busy = new Error(`The lock ${lockPath} is held by another process.`)
           busy.code = 'E_LOCK_BUSY'
           throw busy

package/lib/core/ids.js

@@ -0,0 +1,7 @@
+/**
+ * Shared identifier shapes used by the HTTP layer and the session gateway.
+ * Kept in one place so the route and the preflight cannot drift apart.
+ */
+
+/** DSH session ids: letters, digits and `.`, `_`, `-`; 6–80 characters. */
+export const SESSION_ID_PATTERN = /^[A-Za-z0-9._-]{6,80}$/

package/lib/core/rate-limit.js

@@ -24,8 +24,10 @@ export function createSlidingWindowLimiter({ limit, windowMs, now = Date.now })
 
   return {
     /**
-     * Try to reserve `cost` deletions.
-     * @returns {{ ok: true, remaining: number } | { ok: false, retryAfterMs: number, limit: number }}
+     * Try to reserve `cost` deletions. A reservation that later fails to
+     * delete (rollback, writer busy, …) calls `release()` so the failed
+     * attempt does not spend the minute quota it never used.
+     * @returns {{ ok: true, remaining: number, release: () => void } | { ok: false, retryAfterMs: number, limit: number }}
      */
     take(cost = 1) {
       const current = now()
@@ -36,7 +38,19 @@ export function createSlidingWindowLimiter({ limit, windowMs, now = Date.now })
         return { ok: false, retryAfterMs, limit }
       }
       for (let index = 0; index < cost; index += 1) accepted.push(current)
-      return { ok: true, remaining: limit - accepted.length }
+      return {
+        ok: true,
+        remaining: limit - accepted.length,
+        release() {
+          // Drop only the reservation we just made: remove `cost` stamps equal
+          // to this instant; other concurrent reservations at the same instant
+          // stay in place.
+          for (let index = 0; index < cost; index += 1) {
+            const position = accepted.lastIndexOf(current)
+            if (position !== -1) accepted.splice(position, 1)
+          }
+        },
+      }
     },
 
     /** Current budget without consuming it (used by the preview response). */

package/lib/core/trash.js

@@ -122,6 +122,45 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
       return entries.filter((entry) => entry.status === 'trashed')
     },
 
+    /**
+     * Trash directories whose manifest cannot be read at all: missing
+     * (crashed between allocate and write), corrupt, or unparseable. These
+     * are invisible to restore/purge but must still be listable and
+     * discardable, otherwise a single bad manifest strands the directory on
+     * disk forever.
+     * @returns {Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>}
+     */
+    async scanUnreadable() {
+      await ensureRoot()
+      const out = []
+      let dirents = []
+      try {
+        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
+      } catch {
+        return out
+      }
+      for (const dirent of dirents) {
+        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
+        let raw
+        let reason = 'missing-manifest'
+        try {
+          raw = await fsApi.readFile(join(rootDir, dirent.name, MANIFEST), 'utf8')
+        } catch (error) {
+          if (error?.code !== 'ENOENT') reason = 'unreadable-manifest'
+          out.push({ trashId: dirent.name, reason })
+          continue
+        }
+        try {
+          const parsed = JSON.parse(raw)
+          const readable = parsed !== null && typeof parsed === 'object' && parsed.format === 1 && TRASH_STATUS.includes(parsed.status)
+          if (!readable) out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
+        } catch {
+          out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
+        }
+      }
+      return out
+    },
+
     async remove(trashId) {
       await fsApi.rm(entryDir(trashId), { recursive: true, force: true })
     },

package/lib/host/api.js

@@ -55,13 +55,11 @@ import { createSessionGateway } from './gateway.js'
 import { createMemoryAdapters } from './memory.js'
 import { createFeedbackService } from './feedback.js'
 import { PLUGIN_VERSION } from '../version.js'
+import { SESSION_ID_PATTERN } from '../core/ids.js'
 
 export const ROUTE_PREFIX = '/conversation-recycle-bin/api'
 export const REQUIRED_HEADER = 'x-conversation-recycle-bin'
 const MAX_BODY_BYTES = 256 * 1024
-// DSH's `encodeSegment` allows `.`, `_`, `-`; forked/custom ids can contain a
-// dot, so refusing one made those conversations undeletable.
-const SESSION_ID_PATTERN = /^[A-Za-z0-9._-]{6,80}$/
 
 function isLoopbackHostname(hostname) {
   const value = String(hostname ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '')
@@ -155,9 +153,16 @@ export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopb
       const trustedAppShell = parsed !== null && parsed.protocol === 'dsh-app:' && parsed.hostname === 'app'
       if (trustedAppShell !== true) {
         const requestPort = portOf(read('host'))
-        const originPort = parsed === null ? '' : (parsed.port === '' ? defaultPortFor(parsed.protocol) : parsed.port)
-        const hostnameMatches = parsed !== null && parsed.hostname !== '' && sameHostname(parsed.hostname, requestHostname)
-        const portMatches = originPort !== '' && originPort === (requestPort === '' ? originPort : requestPort)
+        let hostnameMatches = false
+        let portMatches = false
+        if (parsed !== null) {
+          hostnameMatches = parsed.hostname !== '' && sameHostname(parsed.hostname, requestHostname)
+          // A missing request port falls back to the Origin's scheme default
+          // (80/443) instead of matching every Origin port.
+          const effectiveRequestPort = requestPort === '' ? defaultPortFor(parsed.protocol) : requestPort
+          const originPort = parsed.port === '' ? defaultPortFor(parsed.protocol) : parsed.port
+          portMatches = originPort !== '' && originPort === effectiveRequestPort
+        }
         if (!hostnameMatches || !portMatches) {
           return { ok: false, error: new DeleteError('E_FORBIDDEN_ORIGIN', 'The request origin does not match this Host.', { origin }) }
         }
@@ -232,6 +237,9 @@ function readJsonBody(req) {
       if (bytes > MAX_BODY_BYTES) {
         overflow = true
         chunks.length = 0
+        // Respond at once instead of draining the whole oversized body; the
+        // settled flag keeps the later `end` handler from double-settling.
+        finish(new DeleteError('E_BAD_REQUEST', 'Request body exceeds the size limit.', { limit: MAX_BODY_BYTES }, { httpStatus: 413 }))
         return
       }
       chunks.push(chunk)
@@ -355,20 +363,30 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   const confirmations = new Map()
   let mutationChain = Promise.resolve()
   let requestCounter = 0
+  // `/trash` reads and parses every manifest on disk; a short TTL cache keeps
+  // the settings page responsive while every mutation invalidates it, so the
+  // user never sees a stale list after their own action.
+  const TRASH_CACHE_TTL_MS = 1_500
+  let trashCache = null
+  let trashCachedAt = 0
+  function invalidateTrashCache() {
+    trashCache = null
+    trashCachedAt = 0
+  }
 
   /**
    * Serialize one mutation: in-process first (so two HTTP requests never
    * interleave their transactions), then across processes (so a second Host
    * sharing this DSH_HOME cannot write the same manifest concurrently).
    */
-  function serialize(operation) {
+  function serialize(operation, { lockTimeoutMs } = {}) {
     const next = mutationChain.then(async () => {
       // The lock lives in the data dir, which a fresh install has not created
       // yet (the trash store and audit log mkdir their own targets lazily).
       await mkdir(paths.dataDir, { recursive: true }).catch(() => {})
       let release
       try {
-        release = await mutationLockInstance.acquire()
+        release = await mutationLockInstance.acquire(lockTimeoutMs === undefined ? {} : { timeoutMs: lockTimeoutMs })
       } catch (error) {
         if (error?.code === 'E_LOCK_BUSY') {
           throw new DeleteError('E_LOCK_BUSY', 'Another DSH instance is using this recycle bin; retry in a moment.', {})
@@ -502,9 +520,14 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       if (!policy.ok) blocked.push({ sessionId: id, policy: item.policy })
     }
 
-    const memory = config.memory.enabled
-      ? await memoryService.countForSessions(sessionIds)
-      : { total: 0, bySession: Object.fromEntries(sessionIds.map((id) => [id, 0])), protected: 0, adapters: [], disabled: true }
+    // When every session is blocked there is no plan to execute, so the memory
+    // count (index reads + parsing) is skipped rather than computed for nothing.
+    const emptyMemory = { total: 0, bySession: Object.fromEntries(sessionIds.map((id) => [id, 0])), protected: 0, adapters: [] }
+    const memory = !config.memory.enabled
+      ? { ...emptyMemory, disabled: true }
+      : blocked.length === 0
+        ? await memoryService.countForSessions(sessionIds)
+        : { ...emptyMemory, skipped: true }
     const adapterStates = await memoryService.status()
     const confirmation = blocked.length === 0 ? issueConfirmation({ sessionIds, includeMemory, mode }) : null
 
@@ -608,19 +631,31 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       })
     }
 
-    const budget = limiter.take(sessions.length)
-    if (!budget.ok) {
-      throw new DeleteError('E_RATE_LIMITED', `Too many deletions; retry in ${Math.ceil(budget.retryAfterMs / 1000)}s.`, {
-        retryAfterMs: budget.retryAfterMs,
-        limit: budget.limit,
-      })
-    }
-    markConfirmationUsed(validated)
-
+    // Budget is consumed per actually-attempted deletion: a failed item must
+    // not silently spend the minute quota it never used. The very first item
+    // still refuses outright with 429 (the existing contract); once a plan
+    // has started, later exhausted items are recorded as failures.
+    //
+    // A refusal inside the loop uses `continue`, never `break`: `break` used
+    // to drop every session after the exhausted one from both `results` and
+    // `failures`, so a batch of 50 with a 20/min budget left items 22-50
+    // looking like the plan never mentioned them. Under the per-plan
+    // serialize this is still visible via `maxBatchSessions` > budget.
     const request = requestId()
     const results = []
     const failures = []
     for (const session of sessions) {
+      const reservation = limiter.take(1)
+      if (!reservation.ok) {
+        const rateError = new DeleteError('E_RATE_LIMITED', `Too many deletions; retry in ${Math.ceil(reservation.retryAfterMs / 1000)}s.`, {
+          retryAfterMs: reservation.retryAfterMs,
+          limit: reservation.limit,
+        })
+        if (results.length === 0 && failures.length === 0) throw rateError
+        failures.push({ sessionId: session.id, error: rateError.toJSON() })
+        continue
+      }
+      if (!validated.record.used) markConfirmationUsed(validated)
       try {
         const outcome = await performSessionDelete({
           session,
@@ -644,12 +679,16 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
           durationMs: outcome.durationMs,
         })
       } catch (error) {
+        // The deletion never happened: refund the slot so a failed item does
+        // not consume the per-minute quota of a successful one.
+        reservation.release()
         const normalized = asDeleteError(error)
         failures.push({ sessionId: session.id, error: normalized.toJSON() })
         logger.error?.(`[conversation-recycle-bin] delete failed for ${session.id}: ${normalized.message}`)
       }
     }
     gateway.invalidate()
+    invalidateTrashCache()
 
     if (results.length === 0 && failures.length > 0) {
       const first = failures[0].error
@@ -664,6 +703,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     if (entry === null) throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
     const result = await performRestore({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
     gateway.invalidate()
+    invalidateTrashCache()
     return result
   }
 
@@ -679,6 +719,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // cannot be stopped within liveDrainMs, the purge fails and rolls back.
     const result = await performPurge({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
     gateway.invalidate()
+    invalidateTrashCache()
     return result
   }
 
@@ -692,13 +733,40 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     if (typeof confirmPhrase !== 'string' || confirmPhrase.trim() !== 'DELETE') {
       throw new DeleteError('E_CONFIRM_PHRASE', 'Type “DELETE” to discard this incomplete entry.', { expected: 'DELETE' })
     }
-    const entry = await trash.read(trashId)
-    if (entry === null) throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
-    return performDiscard({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
+    let entry = await trash.read(trashId)
+    if (entry === null) {
+      // Missing/corrupt manifest: the directory itself may still be on disk.
+      // Verify it exists, then discard against the actual payload; the disk
+      // checks inside performDiscard still refuse a folder holding a log or
+      // memory files, so a stranded directory can be cleaned without ever
+      // trusting the unreadable manifest.
+      const dir = join(paths.trashDir, trashId)
+      if (!(await ops.pathExists(dir))) {
+        throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
+      }
+      entry = {
+        trashId,
+        sessionId: null,
+        title: null,
+        mode: null,
+        includeMemory: false,
+        deletedAt: 0,
+        updatedAt: 0,
+        status: 'unreadable',
+        memory: { adapters: [], total: 0 },
+        sessionLog: null,
+        catalog: null,
+      }
+    }
+    const result = await performDiscard({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
+    invalidateTrashCache()
+    return result
   }
 
   async function state() {
-    const adapters = await memoryService.status()
+    // Only wire fields the Client renders; adapter `storePath` is an absolute
+    // filesystem handle and must not leave the Host.
+    const adapters = (await memoryService.status()).map(({ id, label, available, reason }) => ({ id, label, available, reason }))
     return {
       enabled: config.enabled,
       version: PLUGIN_VERSION,
@@ -727,10 +795,12 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // Every row carries its own policy verdict: "select all" used to include
     // subagent/orphan/out-of-root conversations that `/preview` then refuses
     // as a whole batch, leaving the user with a disabled button and no hint
-    // which row to uncheck. Soft mode is the widest verdict (hard adds only
-    // the live-session stop), so a row marked deletable here stays deletable.
+    // which row to uncheck. Judge with the configured default mode (the mode
+    // the dialog opens in): with `stopLiveSessions: false`, hard is stricter
+    // than soft for live sessions, so a fixed soft verdict would mark those
+    // rows deletable only for the server to refuse later.
     return sessions.map((session) => {
-      const verdict = evaluateSessionPolicy({ session, workspace: session.workspace, live: session.live, mode: 'soft', config })
+      const verdict = evaluateSessionPolicy({ session, workspace: session.workspace, live: session.live, mode: config.defaultMode, config })
       return {
         id: session.id,
         title: session.title,
@@ -769,14 +839,39 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   }
 
   async function trashList() {
-    // Every manifest is returned: `trashed` entries are the usable recycle bin,
-    // while failed/pending/restoring/purging entries used to be invisible and
-    // impossible to clean up at all. The Client renders them separately.
-    const all = await trash.listAll()
-    return {
+    if (trashCache !== null && now() - trashCachedAt < TRASH_CACHE_TTL_MS) return trashCache
+    // Every readable manifest is returned: `trashed` entries are the usable
+    // recycle bin, while failed/pending/restoring/purging entries used to be
+    // invisible and impossible to clean up at all. Directories whose manifest
+    // is missing/corrupt are surfaced as `unreadable` so they are not stranded
+    // on disk; the Client renders both groups separately.
+    const [all, unreadable] = await Promise.all([trash.listAll(), trash.scanUnreadable()])
+    const result = {
       entries: all.filter((entry) => entry.status === 'trashed').map(serializeEntry),
-      incomplete: all.filter((entry) => entry.status !== 'trashed').map(serializeEntry),
+      incomplete: [
+        ...all.filter((entry) => entry.status !== 'trashed').map(serializeEntry),
+        ...unreadable.map((item) => ({
+          trashId: item.trashId,
+          sessionId: null,
+          title: null,
+          mode: null,
+          includeMemory: false,
+          deletedAt: 0,
+          updatedAt: 0,
+          memory: 0,
+          memoryAdapters: [],
+          hasSessionLog: false,
+          status: 'unreadable',
+          error: {
+            code: item.reason,
+            message: 'The manifest could not be read; discard this folder only after confirming it holds no log or memory files.',
+          },
+        })),
+      ],
     }
+    trashCache = result
+    trashCachedAt = now()
+    return result
   }
 
   async function auditTail(limit) {
@@ -823,72 +918,88 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     }
 
     try {
-        if (method === 'GET' && (path === '' || path === '/state')) {
-          sendJson(res, 200, { ok: true, state: await state() })
-          return
-        }
-        if (method === 'GET' && path === '/sessions') {
-          sendJson(res, 200, { ok: true, sessions: await sessionsForUi() })
-          return
-        }
-        if (method === 'GET' && path === '/trash') {
-          sendJson(res, 200, { ok: true, ...(await trashList()) })
-          return
-        }
-        if (method === 'GET' && path === '/audit') {
-          sendJson(res, 200, { ok: true, ...(await auditTail(url.searchParams.get('limit'))) })
-          return
-        }
-        if (method !== 'POST') {
-          throw new DeleteError('E_BAD_REQUEST', 'This endpoint accepts POST requests only.', {}, { httpStatus: 405 })
-        }
-        const header = req.headers?.[REQUIRED_HEADER]
-        if (header !== '1') {
-          throw new DeleteError('E_FORBIDDEN_ORIGIN', 'Missing the plugin request header.', {})
-        }
-        if (!config.enabled && path !== '/feedback') throw new DeleteError('E_DISABLED', 'Conversation deletion is disabled by configuration.', {})
-        const body = await readJsonBody(req)
-
-        // Feedback is available even when deletion is switched off: the two
-        // switches answer different questions, and a broken mail transport
-        // must not be reported as "deletion disabled".
-        if (path === '/feedback') {
-          const result = await feedbackService.submit(body)
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
+      if (method === 'GET' && (path === '' || path === '/state')) {
+        sendJson(res, 200, { ok: true, state: await state() })
+        return
+      }
+      if (method === 'GET' && path === '/sessions') {
+        sendJson(res, 200, { ok: true, sessions: await sessionsForUi() })
+        return
+      }
+      if (method === 'GET' && path === '/trash') {
+        sendJson(res, 200, { ok: true, ...(await trashList()) })
+        return
+      }
+      if (method === 'GET' && path === '/audit') {
+        sendJson(res, 200, { ok: true, ...(await auditTail(url.searchParams.get('limit'))) })
+        return
+      }
+      // A GET that matched no route is an unknown endpoint (404), not a 405:
+      // 405 is reserved for non-POST verbs on a mounted prefix.
+      if (method === 'GET') {
+        throw new DeleteError('E_NOT_FOUND', 'Unknown endpoint.', { path: path.slice(0, 120) })
+      }
+      if (method !== 'POST') {
+        throw new DeleteError('E_BAD_REQUEST', 'This endpoint accepts POST requests only.', {}, { httpStatus: 405 })
+      }
+      const header = req.headers?.[REQUIRED_HEADER]
+      if (header !== '1') {
+        throw new DeleteError('E_FORBIDDEN_ORIGIN', 'Missing the plugin request header.', {})
+      }
+      if (!config.enabled && path !== '/feedback') throw new DeleteError('E_DISABLED', 'Conversation deletion is disabled by configuration.', {})
+      const body = await readJsonBody(req)
 
-        if (path === '/preview') {
-          const sessionIds = normalizeSessionIds(body)
-          const mode = normalizeMode(body, config)
-          const includeMemory = normalizeBoolean(body, 'includeMemory')
-          sendJson(res, 200, { ok: true, preview: await preview({ sessionIds, includeMemory, mode }) })
-          return
-        }
-        if (path === '/delete') {
-          const result = await serialize(() => deletePlan(body))
-          // `ok` means "the plan was executed", not "every item succeeded".
-          // A partial batch carries `results` + `failures`; marking the whole
-          // response as an error hid those results and made the Client show
-          // "The Host refused the request" while rows had already been deleted.
-          sendJson(res, 200, { ok: true, partial: result.failures.length > 0, ...result })
-          return
-        }
-        if (path === '/trash/restore') {
-          const result = await serialize(() => restoreEntry(body?.trashId))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
-        if (path === '/trash/purge') {
-          const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
-        if (path === '/trash/discard') {
-          const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
+      // Feedback is available even when deletion is switched off: the two
+      // switches answer different questions, and a broken mail transport
+      // must not be reported as "deletion disabled".
+      if (path === '/feedback') {
+        const result = await feedbackService.submit(body)
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+
+      if (path === '/preview') {
+        const sessionIds = normalizeSessionIds(body)
+        const mode = normalizeMode(body, config)
+        const includeMemory = normalizeBoolean(body, 'includeMemory')
+        sendJson(res, 200, { ok: true, preview: await preview({ sessionIds, includeMemory, mode }) })
+        return
+      }
+      if (path === '/delete') {
+        // Upper-bound lock wait mirroring preview's planTimeoutMs: a 50-item
+        // batch legitimately outlives the default 30s, so a second Host waiting
+        // on the lock should not be told "busy" while the first is still
+        // working. Per-session export/restore plus a bounded live drain each.
+        const rawIds = Array.isArray(body?.sessionIds)
+          ? body.sessionIds
+          : typeof body?.sessionId === 'string'
+            ? [body.sessionId]
+            : []
+        const batchCount = Math.max(1, rawIds.length)
+        const lockBudget = Math.min(900_000, 15_000 + batchCount * 16_000 + batchCount * config.liveDrainMs)
+        const result = await serialize(() => deletePlan(body), { lockTimeoutMs: lockBudget })
+        // `ok` means "the plan was executed", not "every item succeeded".
+        // A partial batch carries `results` + `failures`; marking the whole
+        // response as an error hid those results and made the Client show
+        // "The Host refused the request" while rows had already been deleted.
+        sendJson(res, 200, { ok: true, partial: result.failures.length > 0, ...result })
+        return
+      }
+      if (path === '/trash/restore') {
+        const result = await serialize(() => restoreEntry(body?.trashId))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+      if (path === '/trash/purge') {
+        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+      if (path === '/trash/discard') {
+        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
       throw new DeleteError('E_NOT_FOUND', 'Unknown endpoint.', { path: path.slice(0, 120) })
     } catch (error) {
       const normalized = asDeleteError(error)

package/lib/host/feedback.js

@@ -321,7 +321,16 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
         retryAfterMs: Math.max(0, windowMs - (now() - deliveries[0])),
       })
     }
-    deliveries.push(now())
+    const stamp = now()
+    deliveries.push(stamp)
+    // A transport failure must not spend the hourly quota: the caller can
+    // release the slot instead of locking the visitor out for an hour.
+    return {
+      release() {
+        const at = deliveries.indexOf(stamp)
+        if (at !== -1) deliveries.splice(at, 1)
+      },
+    }
   }
 
   async function deliverHttp(message, submission) {
@@ -329,7 +338,14 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
       throw new DeleteError('E_FEEDBACK_TRANSPORT', 'This Host runtime provides no fetch() to deliver feedback.', { transport: 'http' })
     }
     const headers = { 'content-type': 'application/json' }
-    if (settings.apiToken !== '') headers[settings.authHeader.toLowerCase()] = `Bearer ${settings.apiToken}`
+    if (settings.apiToken !== '') {
+      // `Authorization` is the one header whose RFC 7235 grammar mandates an
+      // auth-scheme token; a custom header (X-Api-Key, x-goog-api-key, …)
+      // expects the bare secret. Prefixing `Bearer` unconditionally 401'd
+      // every non-Authorization relay the user pointed us at.
+      const scheme = settings.authHeader.toLowerCase() === 'authorization' ? `Bearer ${settings.apiToken}` : settings.apiToken
+      headers[settings.authHeader.toLowerCase()] = scheme
+    }
     const body = {
       from: (settings.visitorAsFrom === true && submission.email) ? submission.email : (settings.from === '' ? undefined : settings.from),
       to: [settings.to],
@@ -404,13 +420,16 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
         reason: settings.reason,
       })
     }
-    takeSlot()
+    const slot = takeSlot()
     const message = renderFeedbackMessage(submission, { at: now() })
     const startedAt = now()
     try {
       if (settings.transport === 'http') await deliverHttp(message, submission)
       else await deliverSmtp(message, submission)
     } catch (error) {
+      // A failed delivery refunds the slot: a temporary provider outage must
+      // not consume the hourly cap and lock the visitor out for an hour.
+      slot.release()
       const normalized = error instanceof DeleteError
         ? error
         : new DeleteError('E_FEEDBACK_TRANSPORT', 'The feedback message could not be delivered.', {

package/lib/host/gateway.js

@@ -16,6 +16,7 @@
 import { findSessionDir, readJsonFile } from './paths.js'
 import { join } from 'node:path'
 import { isPathInside } from '../core/policy.js'
+import { SESSION_ID_PATTERN } from '../core/ids.js'
 
 const LIST_TTL_MS = 1_500
 const STATE_TTL_MS = 1_500
@@ -177,6 +178,30 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
     }
   }
 
+  /**
+   * Lightweight running probe for the bounded drain: reads only the in-memory
+   * live-sessions table instead of rebuilding the whole session list on every
+   * poll. Returns `undefined` when the service is absent or the entry shape is
+   * unknown, so the caller falls back to a full `inspect()`.
+   * @returns {boolean|undefined}
+   */
+  function probeRunning(sessionId) {
+    const sessions = service('sessions')
+    if (sessions === undefined || typeof sessions.get !== 'function') return undefined
+    let current
+    try {
+      current = sessions.get(sessionId)
+    } catch {
+      return undefined
+    }
+    if (current === null || current === undefined) return false
+    if (typeof current !== 'object') return undefined
+    if (typeof current.running === 'boolean') return current.running
+    if (typeof current.active === 'boolean') return current.active
+    if (typeof current.busy === 'boolean') return current.busy
+    return undefined
+  }
+
   async function workspaceFor(session) {
     const workspaces = await workspaceEntities()
     const byId = workspaces.find((workspace) => workspace.id === session.workspaceId)
@@ -193,10 +218,11 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
   return {
     workspaceState: readWorkspaceState,
     list: loadList,
+    isRunning: probeRunning,
 
     /** Normalize one session; throws E_NOT_FOUND-shaped data as `null`. */
     async inspect(sessionId) {
-      if (typeof sessionId !== 'string' || !/^[A-Za-z0-9._-]{6,80}$/.test(sessionId)) return null
+      if (typeof sessionId !== 'string' || !SESSION_ID_PATTERN.test(sessionId)) return null
       const persistence = service('sessionPersistence')
       let snapshot
       if (persistence !== undefined && typeof persistence.stat === 'function') {

package/lib/host/lifecycle.js

@@ -34,6 +34,12 @@ export function createLifecycleOps({ ctx, gateway, config, now = Date.now, delay
   }
 
   async function inspectRunning(sessionId) {
+    // Cheap path: read the in-memory live table without invalidating and
+    // rebuilding the whole session list on every poll. Only fall back to a
+    // full inspect when the probe cannot answer (absent service, unknown shape).
+    const raw = typeof gateway.isRunning === 'function' ? gateway.isRunning(sessionId) : undefined
+    const probe = raw instanceof Promise ? await raw : raw
+    if (probe !== undefined) return probe === true
     gateway.invalidate()
     const current = await gateway.inspect(sessionId)
     return current !== null && current.running === true

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.2'
+export const PLUGIN_VERSION = '0.3.4'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",
@@ -57,7 +57,7 @@
   },
   "scripts": {
     "test": "node test/manifest.test.mjs && node test/client-module.test.mjs && node test/core.test.mjs && node test/cascade.test.mjs && node test/memory.test.mjs && node test/trash-audit.test.mjs && node test/feedback.test.mjs && node test/api.test.mjs",
-    "check": "node --check lib/index.js && node --check lib/host/feedback.js && node --check client.js && node test/manifest.test.mjs"
+    "check": "node scripts/check-syntax.mjs && node test/manifest.test.mjs"
   },
   "dsh": {
     "manifestVersion": 1,