dsh-conversation-recycle-bin 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -3,6 +3,45 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.8] — 2026-10-26
+
+技术方案评审团（架构 / 安全 / 验收三方）对 0.3.7 的复核结论是 15 条问题、142 条测试全绿但 **NEEDS WORK**。本版把它们全部修掉，测试 142 → **152**。
+
+### Fixed — 数据安全
+
+- **ARCH-1 删除崩溃后记忆永久孤儿**：`lib/core/cascade.js` 的记忆步骤只改内存里的 `entry.memory`，从不落盘。若在"记忆已导出"与"manifest 写入 `status: 'trashed'`"之间崩溃，条目会停在 `pending` 且 `memory.total = 0`，而真实 bundle 只存在于 `<trashId>/memory/<adapter>/bundle.json`；此后 restore（"nothing left to restore"）、discard（"still holds memory files"）、purge（"cannot be purged"）三条路全部拒绝，用户没有任何出口。现在导出后立即 `trash.update(entry.trashId, { memory: bundle })`（失败先 `memory.restoreEntry(bundle)` 补偿再抛）；恢复路径在 `includeMemory` 为真但 manifest 说没有记忆时，用新增的 `memory.readExported()` 从磁盘重建摘要。
+- **ARCH-1 次生风险**：恢复成功后原本无条件 `trash.remove()`，记忆未回灌时会删掉唯一副本。现在只有 `memory/` 目录确实为空（`ops.hasFiles` 探测，异常按"仍有文件"处理）才删条目，返回值新增 `memoryLeftOnDisk`。
+- **R-02 缺 `sessions` 服务时硬删运行中会话**：`lib/host/gateway.js` 的 `isLive()` 原先只看 `sessions`，而宿主的运行判定看 `agents`。现在两个信号任一为真即视为 live，不再跳过 quiesce。
+- **ARCH-3 运行态未知被当成"没在跑"**：`lib/host/lifecycle.js` 的 `inspectRunning()` 现在对"探针与 inspect 都给不出布尔值"的情形 fail-closed 返回 `true`，由 `liveDrainMs` 的 deadline 兜底并回滚归档。
+
+### Fixed — 可用性
+
+- **ARCH-2 / R-01 请求永久挂起（P0）**：两层都有问题，一并修。
+  - 跨进程锁 `lib/core/file-lock.js`：stale 分支删不掉锁文件时**无 sleep、无 deadline**，实测 3 秒内自旋 3235 次、永不返回。现在每轮都 `sleep`、循环顶部检查预算，连续 3 次删不掉即抛 `E_LOCK_BUSY`；stale 判定改为"pid 可证明已死 → 立即破锁 / 无 owner 只按 age / **持有者活着绝不按 age 破**"（长 GC 不再放第二个写者进来）。
+  - 进程内队列 `lib/host/api.js` 的 `serialize()`：`mutationChain.then` 没有任何预算，客户端中止后 Host 照样执行。现在队列预算 = `lockTimeoutMs + 60s` 宽限，超时抛新增的 `E_QUEUE_TIMEOUT`(503)；并在"开跑前"与"拿到跨进程锁后"各查一次客户端是否已断开（`clientGone()`），断开则抛新增的 `E_ABANDONED`(409)，绝不落盘。
+- **R-07 软删静默掐断当前回合**：软删同样 `archiveSession(id, { stopActivity: true })`，会中断正在跑的回合。`lib/core/policy.js` 现在对 `mode === 'soft' && live` 给出明确 warning，预览页在点击前就会显示。
+- **R-03 恢复后把"已归档"变成"可见"**：`inspect()` 原先 `archived: fromList?.archived ?? false`，而 `controller.list()` 不保证携带归档态。现在以 `workspaceRegistry` 为权威（`state.archived.has(id) || fromList?.archived === true`，pinned 同理），恢复才真正"回到删除前的状态"。
+- **ARCH-5 能力判定口径分裂**：新增 `entryCapabilities(entry, disk)` 统一 restore/purge/discard 的判定，`serializeEntry()` 额外输出 `capabilities`，避免再出现"UI 给按钮、三个接口全拒"的死胡同。
+
+### Fixed — 安全加固
+
+- **S1 鉴权层异常时 fail-open**：`connection.requestRejection()` 抛错原先被 `catch { rejection = undefined }` 吞掉并放行。现在记 `logger.error` 并返回 503 `E_INTERNAL`；任何非 `undefined/null` 的拒绝值一律拒绝（`401`→401、`403`→403、其它→503）。
+- **S5 无 connection 服务时本机任意进程可删**：新增 `config.requireConnection`（**默认 `true`**）。组合里没有 `connection` 服务时，所有路由返回 401 `E_UNAUTHORIZED` 并提示如何显式降级；`config.schema.json` 已同步。
+- **S2 非法回收站 id 变成目录存在性探测**：`discard` 入口先过 `isTrashId()`，`trash.entryDir()` 也改抛 `DeleteError('E_BAD_REQUEST')` 而不是普通 `Error`（原先逃逸成 500，且与 404 可区分）。
+- **S3 manifest 可指向任意路径**：恢复前校验 `sessionLog.from` 必须在 `sessionsRoot` 内、`sessionLog.to` 必须在回收站目录内，否则 `E_TRASH_CONFLICT`。
+- **S4 彻底删除后标题仍留在审计里**：purge / discard 的审计记录不再写 `title`；`/trash/audit` 的返回统一过 `redactDetails()`，绝对路径不上线。
+
+### Maintenance
+
+- 测试 142 → **152**：新增"stale 锁删不掉必须报错而不是自旋"、"非法 id 必须 400"、"鉴权层抛错必须 503"、"客户端已断开不得执行"、"记忆 bundle 必须落盘"、"pending 条目可从磁盘恢复"、"manifest 越界必须拒绝"、"purge 审计不含标题"、"软删运行中会话必须有 warning"、"无 connection 服务默认被拒"。
+- `lib/version.js` 与 `package.json` 同步到 0.3.8。
+
+## [0.3.7] — 2026-10-24
+
+### Fixed
+
+- **深色主题下主按钮文字不可见（「确认按钮消失」）**：`.dc-btn-primary` 用 `--dsw-alias-brand-primary` 作填充、却把文字写死成 `#fff`。该 token 是**会随主题反转的填充色**：浅色主题为 `neutral-bluish-1000`（rgb(15,17,21)，近黑），深色主题为 `neutral-bluish-50`（rgb(249,250,251)，近白）。于是深色主题下是「近白底 + 白字」，对比度约 1.04:1，删除成功对话框右下角只剩一个白块。改为填充用 `--dsw-alias-button-primary-fill`、文字用 `--dsw-alias-label-primary-inverted`（浅色 = 白、深色 = `neutral-bluish-800` rgb(53,54,56)），悬停改用 `--dsw-alias-button-primary-hover` 并去掉 `filter:brightness(.94)`。新增用例把这条配对钉住，防止再用字面色值。
+
 ## [0.3.6] — 2026-10-24
 
 对应 `AUDIT-2026-10-24-desktop-web-rc3.md` §7 的四条「建议动作」（A2 / A3 / A5 / A6）。同一节的 A1、A4、A7、A8 复核后判定为产品取舍（不申报未直接消费的 client 依赖、不导出 `Config` 以免设置页脱离非表单语义、归档读保留双源缓存、`missingSessionPaths` 保持成员判定），本版不改。

package/README.md

@@ -101,6 +101,8 @@ memory  →  messages  →  session/catalog
    - 先对**全部**会话做策略预检，任一被拒绝则整批不执行（不会半成功）；
    - 逐会话执行 `quiesce(live) → memory → messages → session/catalog` 事务；
    - 所有 mutation（delete/restore/purge/discard）串行经过进程内链 + `<dataDir>/mutation.lock` 跨进程文件锁：桌面端与 `dsh web` 共享一个 `DSH_HOME` 时，第二个实例的并发删除会拿到 `E_LOCK_BUSY` 而不是写坏同一份 manifest；
+   - 队列与锁都有预算，不会无限等待：排队超过 `lockTimeoutMs + 60s` 抛 `E_QUEUE_TIMEOUT`（503，**未执行任何动作**，可安全重试）；客户端在排队或取锁期间断开（关标签页/刷新）抛 `E_ABANDONED`（409，同样未执行）。两者都表示"什么都没发生"，与 `E_TRANSACTION_FAILED`（可能已部分执行）区分开；
+   - 锁文件 stale 判定：pid 可证明已死才立即破锁；无 owner 的锁只按 age 破；**持有者活着时绝不按 age 破**（否则长 GC 会放进第二个写者）。连续 3 次删不掉 stale 锁即 `E_LOCK_BUSY`，不空转；
    - 返回 `{ok: true, partial, results, failures}`：`ok` 表示计划已执行，`partial` 表示有会话失败；只有**全部**失败时才抛首个错误（HTTP 状态来自 `ERROR_STATUS`，错误码保留真实策略码）。
 3. `GET /trash`（返回 `entries`（可恢复）与 `incomplete`（failed/pending/restoring/purging））、`POST /trash/restore`、`POST /trash/purge`（必须输入 `DELETE`）、`POST /trash/discard`（清理未完成条目，必须输入 `DELETE`；仍保存会话日志的条目应走「恢复」而不是 discard）。未完成条目若还留着会话日志，设置页会给出「恢复」按钮，可以直接把它恢复回会话列表。
 4. `GET /audit?limit=N`。
@@ -119,6 +121,7 @@ memory  →  messages  →  session/catalog
 | 失败半删 | 每会话事务 + 逆序回滚；回滚失败进入错误详情和审计 |
 | 不可追溯 | `<DSH_HOME>/delete-conversation/audit.jsonl` 追加成功/失败/回滚/拒绝/恢复/清理记录；设置页可查看 |
 | 外部记忆存储损坏 | 灵枢适配器持有其 `_index.json.lock`，先写 restore bundle 再原子改写索引；任何一步失败先还原正文与索引；详情见 §5.3 |
+| 组合里没有 `connection` 服务 | 默认 **`requireConnection: true`**：探测不到 `connection.requestRejection` 时所有路由返回 401 `E_UNAUTHORIZED`，因为本路由自己的 loopback/Origin 栅栏**分不清本机上的两个进程**（任何本机进程都能伪造 `Host: 127.0.0.1` 与私有 header）。确实要跑无 `connection` 的裁剪组合时才设 `requireConnection: false`，并自行承担"本机任意进程可调用删除接口"的风险 |
 
 反代部署（`dsh web --public-url https://host/ui/`）时，代理会把外部主机名放进 `Host`，插件的回环校验会以 `E_FORBIDDEN_HOST` 拒绝。用 `allowedHosts` 精确放行，而不是把 `allowNonLoopback` 整体打开：
 

package/client.js

@@ -1984,8 +1984,14 @@ window.__ModuleLoader__.load({
 .dc-btn{height:30px;padding:0 12px;border-radius:7px;border:1px solid var(--dsw-alias-border-l2,#c9cdd4);background:var(--dsw-alias-bg-layer-1,#f7f8fa);color:var(--dsw-alias-label-primary,#1f2329);font:inherit;font-size:12px;cursor:pointer;display:inline-flex;align-items:center;gap:5px}
 .dc-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,#eff0f2)}
 .dc-btn:disabled{opacity:.5;cursor:not-allowed}
-.dc-btn-primary{background:var(--dsw-alias-brand-primary,#4d6bfe);border-color:var(--dsw-alias-brand-primary,#4d6bfe);color:#fff}
-.dc-btn-primary:hover:not(:disabled){filter:brightness(.94);background:var(--dsw-alias-brand-primary,#4d6bfe)}
+/* --dsw-alias-brand-primary is a FILL that flips with the theme: near-black
+   (#0f1115) in light, near-white (#f9fafb) in dark. Pairing it with a hard-coded
+   white label made the primary button's text invisible on dark (contrast
+   ~1.04:1) — that is the "确认按钮消失" report. The design system's counterpart
+   for text on a primary fill is --dsw-alias-label-primary-inverted: white in
+   light, neutral-800 (#353638) in dark. */
+.dc-btn-primary{background:var(--dsw-alias-button-primary-fill,var(--dsw-alias-brand-primary,#4d6bfe));border-color:var(--dsw-alias-button-primary-fill,var(--dsw-alias-brand-primary,#4d6bfe));color:var(--dsw-alias-label-primary-inverted,#fff)}
+.dc-btn-primary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover,var(--dsw-alias-brand-primary,#4d6bfe))}
 .dc-btn-danger{color:var(--dsw-alias-state-error-primary,#d93026);border-color:var(--dsw-alias-state-error-primary,#d93026);background:transparent}
 .dc-btn-danger:hover:not(:disabled){background:rgba(217,48,38,.08)}
 .dc-error{font-size:12px;line-height:1.55;padding:8px 10px;border-radius:8px;margin:8px 0;color:var(--dsw-alias-state-error-primary,#d93026);background:rgba(217,48,38,.08);border:1px solid rgba(217,48,38,.28)}

package/config.schema.json

@@ -8,6 +8,7 @@
   "properties": {
     "enabled": { "type": "boolean", "default": true, "description": "Master switch. When false the route answers 503 and the UI hides its entries." },
     "requireSameOrigin": { "type": "boolean", "default": true, "description": "Reject requests whose Origin does not match the request's full authority (hostname AND effective port; a missing port defaults by the Origin's own scheme). The desktop shell source dsh-app://app is trusted, matching DSH's own fence." },
+    "requireConnection": { "type": "boolean", "default": true, "description": "Refuse requests when the Host exposes no `connection` service. The loopback/origin fence cannot tell two local processes apart, so without a connection layer any process on this machine could delete a conversation. Set false only for a trusted composition that has no connection service." },
     "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests from any authority, not just loopback. Prefer allowedHosts when a reverse proxy presents a known hostname." },
     "allowedHosts": {
       "type": "array", "items": { "type": "string" }, "maxItems": 32, "default": [],

package/lib/core/cascade.js

@@ -129,10 +129,22 @@ export async function performSessionDelete({
       name: 'memory',
       run: async () => {
         const bundle = await ops.memory.exportForSession(session.id, dir)
+        try {
+          // Persist the summary immediately. The bundle files are already on
+          // disk at this point; without this write a crash before the final
+          // manifest left a `pending` entry whose manifest claimed
+          // `memory.total: 0`, and restore/purge/discard then all refused it —
+          // the memory stayed stranded in the entry directory forever.
+          await trash.update(entry.trashId, { memory: bundle })
+        } catch (error) {
+          await ops.memory.restoreEntry(bundle).catch(() => {})
+          throw error
+        }
         entry.memory = bundle
         return async () => {
           await ops.memory.restoreEntry(bundle)
           entry.memory = emptyMemorySummary()
+          await trash.update(entry.trashId, { memory: emptyMemorySummary() }).catch(() => {})
         }
       },
     })
@@ -258,6 +270,36 @@ export async function performSessionDelete({
  */
 const RESTORABLE_STATUSES = new Set(['trashed', 'pending', 'failed', 'restoring', 'purging'])
 
+/** Statuses a purge may start from (`restored` = an interrupted restore). */
+const PURGEABLE_STATUSES = new Set(['trashed', 'restored'])
+
+/**
+ * The single answer to "what may be done with this entry".
+ *
+ * The UI used to decide from `status !== 'trashed'` while restore/purge/discard
+ * each re-derived their own predicate, which is how a row could be rendered
+ * with a button the route then refused. Status-only questions live here; the
+ * disk-dependent half (`canDiscard` while payload is still present) stays with
+ * the caller, which is the only side that can stat the entry directory.
+ *
+ * @param {{ status?: unknown }} entry
+ * @param {{ hasLogFiles?: boolean|null, hasMemoryFiles?: boolean|null }} [disk]
+ */
+export function entryCapabilities(entry, disk = {}) {
+  const status = typeof entry?.status === 'string' && entry.status !== '' ? entry.status : 'unknown'
+  const hasLogFiles = disk.hasLogFiles ?? null
+  const hasMemoryFiles = disk.hasMemoryFiles ?? null
+  return {
+    status,
+    canRestore: RESTORABLE_STATUSES.has(status),
+    canPurge: PURGEABLE_STATUSES.has(status),
+    // Discard is the escape hatch for entries that never committed: it is
+    // refused while a payload copy still exists, because deleting the folder
+    // would destroy the only copy of a log or a memory bundle.
+    canDiscard: status !== 'trashed' && hasLogFiles !== true && hasMemoryFiles !== true,
+  }
+}
+
 /**
  * Restore ONE recycle-bin entry.
  *
@@ -277,15 +319,49 @@ const RESTORABLE_STATUSES = new Set(['trashed', 'pending', 'failed', 'restoring'
  */
 export async function performRestore({ entry, ops, trash, audit, now = Date.now, actor = 'local-user', source = 'web-ui', requestId = null }) {
   const previousStatus = entry.status
-  if (!RESTORABLE_STATUSES.has(previousStatus)) {
+  if (!entryCapabilities(entry).canRestore) {
     throw new DeleteError('E_TRASH_CONFLICT', 'This recycle-bin entry is not in a restorable state.', { trashId: entry.trashId, status: previousStatus })
   }
   const sessionLog = entry.sessionLog !== null && entry.sessionLog !== undefined && typeof entry.sessionLog === 'object'
     ? entry.sessionLog
     : null
   const catalog = entry.catalog !== null && entry.catalog !== undefined && typeof entry.catalog === 'object' ? entry.catalog : null
-  const hasMemory = entry.includeMemory === true && entry.memory !== null && typeof entry.memory === 'object' && (entry.memory.total ?? 0) > 0
+  let memorySummary = entry.memory !== null && entry.memory !== undefined && typeof entry.memory === 'object' ? entry.memory : null
+  let hasMemory = entry.includeMemory === true && memorySummary !== null && (memorySummary.total ?? 0) > 0
+  // A delete that crashed between "memory bundle exported" and "manifest
+  // written" leaves the bundles on disk while the manifest still says
+  // `total: 0`. Rebuild the summary from the directory instead of claiming
+  // there is nothing to restore (which made the entry impossible to finish).
+  if (!hasMemory && entry.includeMemory === true && typeof ops.memory?.readExported === 'function') {
+    const entryDir = typeof trash?.entryDir === 'function' ? trash.entryDir(entry.trashId) : null
+    if (typeof entryDir === 'string') {
+      const recovered = await ops.memory.readExported(entryDir).catch(() => null)
+      if (recovered !== null && (recovered.total ?? 0) > 0) {
+        memorySummary = recovered
+        hasMemory = true
+      }
+    }
+  }
   const canStat = typeof ops.pathExists === 'function'
+  // Manifest paths are untrusted input: `restore` moves `from` → `to`, so a
+  // hand-edited manifest could otherwise make this plugin a confused proxy
+  // that stats and moves arbitrary directories. Both sides must stay inside
+  // their own storage roots.
+  if (sessionLog !== null) {
+    const fromOk = typeof ops.isInsideSessionsRoot === 'function'
+      ? ops.isInsideSessionsRoot(sessionLog.from) === true
+      : true
+    const toOk = typeof ops.isInsideTrashDir === 'function'
+      ? ops.isInsideTrashDir(sessionLog.to) === true
+      : true
+    if (!fromOk || !toOk) {
+      throw new DeleteError(
+        'E_TRASH_CONFLICT',
+        'This recycle-bin entry points outside its own storage; restore is unsafe.',
+        { trashId: entry.trashId, fromInsideSessions: fromOk, toInsideTrash: toOk },
+      )
+    }
+  }
   const logInTrash = sessionLog !== null && (!canStat || await ops.pathExists(sessionLog.to))
   const logInPlace = sessionLog !== null && canStat && await ops.pathExists(sessionLog.from)
   const logMissing = sessionLog !== null && !logInTrash && !logInPlace
@@ -326,7 +402,7 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
       run: async () => {
         // `restoreEntry` is a historical API that does not produce an undo;
         // calling an undefined undo during a later rollback used to throw.
-        const undo = await ops.memory.restoreEntry(entry.memory)
+        const undo = await ops.memory.restoreEntry(memorySummary)
         return async () => {
           if (typeof undo === 'function') await undo()
         }
@@ -383,8 +459,15 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
     durationMs: now() - startedAt,
     source,
   })
-  await trash.remove(entry.trashId).catch(() => {})
-  return { trashId: entry.trashId, sessionId: entry.sessionId }
+  // Only clear the entry directory once its memory bundles are actually gone.
+  // `restoreEntry` removes the bundles it consumed; if memory files are still
+  // there (an adapter was uninstalled, a bundle was unreadable) removing the
+  // directory here would silently destroy the only remaining copy.
+  const memoryFilesLeft = typeof ops.hasFiles === 'function' && typeof trash?.entryDir === 'function'
+    ? await ops.hasFiles(join(trash.entryDir(entry.trashId), 'memory')).catch(() => true)
+    : false
+  if (!memoryFilesLeft) await trash.remove(entry.trashId).catch(() => {})
+  return { trashId: entry.trashId, sessionId: entry.sessionId, memoryLeftOnDisk: memoryFilesLeft }
 }
 
 /**
@@ -405,7 +488,7 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
  * @param {string} [input.requestId]
  */
 export async function performPurge({ entry, ops, trash, audit, now = Date.now, actor = 'local-user', source = 'web-ui', requestId = null }) {
-  if (!['trashed', 'restored'].includes(entry.status)) {
+  if (!entryCapabilities(entry).canPurge) {
     throw new DeleteError('E_TRASH_CONFLICT', 'This recycle-bin entry cannot be purged in its current state.', { trashId: entry.trashId, status: entry.status })
   }
   const startedAt = now()
@@ -473,7 +556,6 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
         action: 'purge',
         result: result.rolledBack ? 'rolled-back' : 'rollback-incomplete',
         sessionId: entry.sessionId,
-        title: entry.title,
         trashId: entry.trashId,
         actor,
         requestId,
@@ -490,7 +572,6 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
     action: 'purge',
     result: 'success',
     sessionId: entry.sessionId,
-    title: entry.title,
     trashId: entry.trashId,
     actor,
     requestId,
@@ -538,8 +619,12 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
     })
   }
   const holdsMemory = typeof ops.hasFiles === 'function' ? await ops.hasFiles(join(entryDir, 'memory')) : false
-  if (holdsMemory) {
-    throw new DeleteError('E_TRASH_CONFLICT', 'This incomplete entry still holds memory files; restore or purge it instead of discarding it.', {
+  // The status half of the decision is shared with the UI; the two refusals
+  // below stay separate because their advice differs (purge vs restore).
+  const capabilities = entryCapabilities(entry, { hasLogFiles: holdsLog, hasMemoryFiles: holdsMemory })
+  if (holdsMemory || !capabilities.canDiscard) {
+    const which = holdsMemory ? 'memory files' : 'payload'
+    throw new DeleteError('E_TRASH_CONFLICT', `This incomplete entry still holds ${which}; restore or purge it instead of discarding it.`, {
       trashId: entry.trashId,
       status: entry.status,
     })
@@ -552,7 +637,6 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
       action: 'discard',
       result: 'success',
       sessionId: entry.sessionId,
-      title: entry.title,
       trashId: entry.trashId,
       status: entry.status,
       actor,

package/lib/core/config.js

@@ -12,6 +12,12 @@
 export const DEFAULTS = deepFreeze({
   enabled: true,
   requireSameOrigin: true,
+  // Refuse every request when the Host has no `connection` service. The
+  // loopback/origin fence below cannot distinguish two local processes, so
+  // without a connection layer any process on this machine could delete a
+  // conversation. Set false only for a composition that genuinely has no
+  // connection service and is trusted end to end.
+  requireConnection: true,
   allowNonLoopback: false,
   // Exact authorities a prefix-stripping reverse proxy may present in `Host`
   // (`app.example`, `app.example:8443`, `[::1]:8443`). Empty = loopback only.
@@ -240,6 +246,7 @@ export function normalizeConfig(raw) {
   const value = {
     enabled: readBool(source.enabled, DEFAULTS.enabled, 'enabled', warnings),
     requireSameOrigin: readBool(source.requireSameOrigin, DEFAULTS.requireSameOrigin, 'requireSameOrigin', warnings),
+    requireConnection: readBool(source.requireConnection, DEFAULTS.requireConnection, 'requireConnection', warnings),
     allowNonLoopback: readBool(source.allowNonLoopback, DEFAULTS.allowNonLoopback, 'allowNonLoopback', warnings),
     allowedHosts: readHostList(source.allowedHosts, 'allowedHosts', warnings),
     allowOrphanSessions: readBool(source.allowOrphanSessions, DEFAULTS.allowOrphanSessions, 'allowOrphanSessions', warnings),

package/lib/core/errors.js

@@ -32,6 +32,11 @@ export const ERROR_STATUS = Object.freeze({
   E_TRASH_CONFLICT: 409,
   E_MEMORY_FAILED: 500,
   E_LOCK_BUSY: 409,
+  // A mutation that never got its turn, and one whose client hung up first.
+  // Both mean "no work was done", which is exactly what the Client needs to
+  // know before it retries or refreshes.
+  E_QUEUE_TIMEOUT: 503,
+  E_ABANDONED: 409,
   // Feedback channel: its own codes, so the Client can distinguish "this Host
   // has no mail transport" from "the transport refused the message".
   E_FEEDBACK_DISABLED: 503,

package/lib/core/file-lock.js

@@ -12,13 +12,17 @@
  *   - acquisition creates `<lockPath>` with `wx`, writes `{pid, nonce, at}`;
  *   - a holder refreshes the file mtime on a heartbeat, so a long operation is
  *     never mistaken for a crashed one;
- *   - a lock is stale when its mtime is older than `staleMs`, or when the
- *     recorded pid is provably gone; a stale lock is removed and retried;
+ *   - a lock whose recorded pid is provably gone is stale and is broken at
+ *     once; an ownerless (foreign/legacy) lock is stale only by age;
+ *   - a lock whose owner is still alive is NEVER broken by age alone: a long
+ *     GC pause or a suspended process must not let a second writer in;
  *   - release only removes the file when it still carries this owner's nonce,
  *     so a lock broken by a peer cannot make us delete the peer's lock.
  *
- * Every wait sleeps, and the wait budget is checked on every iteration: a
- * held lock can never spin forever (the bug this module replaces).
+ * Every iteration sleeps and re-checks the wait budget, including the
+ * stale-break path: a lock file that cannot be removed (Windows exclusive
+ * handle, AV/indexer, read-only volume) used to spin without ever sleeping or
+ * throwing, which hung the whole mutation chain behind it.
  */
 import * as defaultFs from 'node:fs/promises'
 import { randomBytes } from 'node:crypto'
@@ -55,6 +59,10 @@ function parseOwner(raw) {
  * @param {number} [options.staleMs] age after which an ownerless lock is broken
  * @param {number} [options.heartbeatMs] mtime refresh interval while held
  * @param {number} [options.retryMs] poll interval
+ * @param {number} [options.maxBreakFailures] consecutive failed stale-lock
+ *   removals tolerated before giving up with `E_LOCK_BUSY`
+ * @param {(message: string) => void} [options.warn] receives lock files that
+ *   could not be cleaned up (never silently swallowed)
  * @param {() => number} [options.now]
  * @param {(ms: number) => Promise<void>} [options.sleep]
  * @param {(pid: number) => boolean} [options.isProcessAlive]
@@ -67,6 +75,8 @@ export function createFileLock({
   staleMs = 120_000,
   heartbeatMs = 5_000,
   retryMs = 50,
+  maxBreakFailures = 3,
+  warn = () => {},
   now = Date.now,
   sleep = sleepDefault,
   isProcessAlive = defaultIsProcessAlive,
@@ -84,9 +94,20 @@ export function createFileLock({
   async function acquire({ timeoutMs: waitBudget = timeoutMs } = {}) {
     const nonce = randomBytes(8).toString('hex')
     const started = now()
+    const deadline = started + Math.max(0, Number(waitBudget) || 0)
     let handle = null
+    let breakFailures = 0
+
+    const busyError = () => {
+      const busy = new Error(`The lock ${lockPath} is held by another process.`)
+      busy.code = 'E_LOCK_BUSY'
+      return busy
+    }
 
     while (handle === null) {
+      // Checked before every attempt, including the stale-break path below:
+      // a lock that exists but cannot be removed must still end the wait.
+      if (now() >= deadline) throw busyError()
       try {
         handle = await fsApi.open(lockPath, 'wx')
       } catch (error) {
@@ -106,15 +127,27 @@ export function createFileLock({
           // Unreadable owner text is treated as ownerless, not as a crash.
         }
         const deadOwner = owner.pid !== null && !isProcessAlive(owner.pid)
-        if (age > staleMs || deadOwner) {
-          await fsApi.rm(lockPath, { force: true }).catch(() => {})
+        // A provably dead owner is always breakable. An ownerless file (foreign
+        // or legacy lock) is only breakable by age. A live owner is never
+        // broken by age: heartbeat refresh can lag behind a long GC pause.
+        const stale = deadOwner || (owner.pid === null && age > staleMs)
+        if (stale) {
+          try {
+            await fsApi.rm(lockPath, { force: true })
+            breakFailures = 0
+          } catch (rmError) {
+            breakFailures += 1
+            if (breakFailures >= maxBreakFailures) {
+              const stuck = new Error(
+                `The lock ${lockPath} is stale but could not be removed (${rmError?.code ?? 'unknown'}).`,
+              )
+              stuck.code = 'E_LOCK_BUSY'
+              throw stuck
+            }
+          }
+          await sleep(retryMs)
           continue
         }
-        if (now() - started >= waitBudget) {
-          const busy = new Error(`The lock ${lockPath} is held by another process.`)
-          busy.code = 'E_LOCK_BUSY'
-          throw busy
-        }
         await sleep(retryMs)
         continue
       }
@@ -142,7 +175,16 @@ export function createFileLock({
       clearInterval(heartbeat)
       try {
         const owner = parseOwner(await fsApi.readFile(lockPath, 'utf8').catch(() => ''))
-        if (owner.nonce === nonce) await fsApi.rm(lockPath, { force: true }).catch(() => {})
+        if (owner.nonce === nonce) {
+          try {
+            await fsApi.rm(lockPath, { force: true })
+          } catch (error) {
+            // A lock we could not remove stays behind; the next acquire may
+            // find it stale and also fail to break it. Say so instead of
+            // leaving a silent trap for the next mutation.
+            warn(`file-lock: could not remove ${lockPath} (${error?.code ?? 'unknown'})`)
+          }
+        }
       } finally {
         await handle?.close().catch(() => {})
       }

package/lib/core/memory/registry.js

@@ -13,8 +13,8 @@
  * store path, so a "generic" adapter configured at the 灵枢 index cannot make
  * the preview count the same entries twice.
  */
-import { readFile, rm } from 'node:fs/promises'
-import { dirname } from 'node:path'
+import { readFile, readdir, rm } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
 import { DeleteError } from '../errors.js'
 
 function emptySummary() {
@@ -185,5 +185,53 @@ export function createMemoryService({ adapters, config, now = Date.now }) {
         await rm(dirname(bundlePath), { recursive: true, force: true }).catch(() => {})
       }
     },
+
+    /**
+     * Rebuild a memory summary from the bundles a crashed delete left on disk.
+     *
+     * `exportForSession` writes `<entryDir>/memory/<adapter>/bundle.json` and
+     * only then returns; the caller writes the manifest afterwards. A crash in
+     * between used to strand those files: the manifest still said `total: 0`,
+     * restore answered "nothing left to restore", and the only copy of the
+     * user's memory became unreachable. Reading the directory back lets restore
+     * finish the job instead.
+     *
+     * @param {string} entryDir the recycle-bin entry directory
+     * @returns {Promise<{adapters: object[], total: number, protected: number}>}
+     */
+    async readExported(entryDir) {
+      if (typeof entryDir !== 'string' || entryDir === '') return emptySummary()
+      const root = join(entryDir, 'memory')
+      let dirents = []
+      try {
+        dirents = await readdir(root, { withFileTypes: true })
+      } catch {
+        return emptySummary()
+      }
+      const adapters = []
+      for (const dirent of dirents) {
+        if (!dirent.isDirectory()) continue
+        const bundlePath = join(root, dirent.name, 'bundle.json')
+        let parsed
+        try {
+          parsed = JSON.parse(await readFile(bundlePath, 'utf8'))
+        } catch {
+          continue
+        }
+        const count = typeof parsed?.count === 'number'
+          ? parsed.count
+          : Array.isArray(parsed?.entries)
+            ? parsed.entries.length
+            : 0
+        if (count <= 0) continue
+        adapters.push({
+          id: dirent.name,
+          label: byId.get(dirent.name)?.label ?? dirent.name,
+          count,
+          bundlePath,
+        })
+      }
+      return { adapters, total: adapters.reduce((sum, adapter) => sum + adapter.count, 0), protected: 0 }
+    },
   }
 }

package/lib/core/policy.js

@@ -106,6 +106,13 @@ export function evaluateSessionPolicy({ session, workspace, live, mode, config }
     warnings.push('The conversation is open in a live agent; it will be stopped before its log is removed.')
   }
 
+  // A soft delete also quiesces the session (`archiveSession(id, { stopActivity:
+  // true })`), so it interrupts a running turn exactly like a hard delete does.
+  // Say so before the click instead of after the round died.
+  if (mode === 'soft' && live) {
+    warnings.push('The conversation is running right now; a soft delete stops the current turn before moving it to the recycle bin.')
+  }
+
   if (session?.blank === true) warnings.push('This is an empty conversation.')
 
   return { ok: true, warnings }

package/lib/core/trash.js

@@ -16,6 +16,7 @@
  */
 import { mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
+import { DeleteError } from './errors.js'
 
 const MANIFEST = 'manifest.json'
 const TRASH_ID_PATTERN = /^[0-9a-z]{2,40}-[0-9a-z]{2,20}$/
@@ -66,7 +67,10 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
 
   function entryDir(trashId) {
     if (!isTrashId(trashId)) {
-      throw new Error(`invalid trash id: ${String(trashId)}`)
+      // A plain Error here escaped as `E_INTERNAL 500` and, worse, was
+      // distinguishable from `E_TRASH_NOT_FOUND 404`, which made malformed ids
+      // an existence probe. Keep it a typed, user-facing refusal.
+      throw new DeleteError('E_BAD_REQUEST', 'The recycle-bin id is malformed.', {})
     }
     return join(rootDir, trashId)
   }

package/lib/host/api.js

@@ -42,11 +42,12 @@ import { randomBytes } from 'node:crypto'
 import { mkdir, readdir, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { DeleteError, ERROR_STATUS, asDeleteError, toWireError } from '../core/errors.js'
+import { redactDetails } from '../core/redact.js'
 import { createAuditLog } from '../core/audit.js'
-import { createTrashStore } from '../core/trash.js'
+import { createTrashStore, isTrashId } from '../core/trash.js'
 import { createMemoryService } from '../core/memory/registry.js'
-import { performSessionDelete, performPurge, performRestore, performDiscard } from '../core/cascade.js'
-import { evaluateSessionPolicy } from '../core/policy.js'
+import { performSessionDelete, performPurge, performRestore, performDiscard, entryCapabilities } from '../core/cascade.js'
+import { evaluateSessionPolicy, isPathInside } from '../core/policy.js'
 import { createSlidingWindowLimiter } from '../core/rate-limit.js'
 import { createFileLock } from '../core/file-lock.js'
 import { createCatalogOps, createSessionLogOps } from './catalog.js'
@@ -366,6 +367,9 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     lockPath: join(paths.dataDir, 'mutation.lock'),
     timeoutMs: 30_000,
     staleMs: 120_000,
+    // A lock file we cannot delete used to vanish into a silent `.catch`: the
+    // next acquire then found it stale, failed to break it, and spun forever.
+    warn: (message) => logger.warn?.(`[conversation-recycle-bin] ${message}`),
   })
   // Which UI asked: the desktop Electron shell and `dsh web` share this code,
   // and the audit trail used to record both as `web-ui`.
@@ -392,6 +396,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return false
       }
     },
+    // Manifest paths are data, not truth: a hand-edited manifest must not turn
+    // "restore" into a proxy for stat/move on arbitrary directories.
+    isInsideSessionsRoot: (target) => typeof target === 'string' && target !== '' && isPathInside(paths.sessionsRoot, target),
+    isInsideTrashDir: (target) => typeof target === 'string' && target !== '' && isPathInside(paths.trashDir, target),
   }
 
   /** @type {Map<string, { planKey: string, sessionIds: string[], includeMemory: boolean, mode: 'soft'|'hard', phrase: string, issuedAt: number, expiresAt: number, used: boolean }>} */
@@ -413,9 +421,29 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
    * Serialize one mutation: in-process first (so two HTTP requests never
    * interleave their transactions), then across processes (so a second Host
    * sharing this DSH_HOME cannot write the same manifest concurrently).
+   *
+   * The in-process queue is bounded too. It used to be an unbounded promise
+   * chain: a request whose client had already given up still ran minutes
+   * later, and one stuck holder hung every later mutation forever. Now:
+   *   - `shouldAbort` is checked before the operation runs (twice: when the
+   *     chain reaches us and again after the cross-process lock), so a client
+   *     that disconnected changes nothing;
+   *   - the wait has a budget derived from the operation's own lock budget
+   *     plus a grace period, so it can never fire before a legitimate holder
+   *     finishes, and never waits forever either.
    */
-  function serialize(operation, { lockTimeoutMs } = {}) {
+  function serialize(operation, { lockTimeoutMs, shouldAbort } = {}) {
+    const graceMs = 60_000
+    const queueBudgetMs = lockTimeoutMs === undefined ? 30_000 + graceMs : lockTimeoutMs + graceMs
+    let abandoned = false
+    const aborted = () => typeof shouldAbort === 'function' && shouldAbort() === true
     const next = mutationChain.then(async () => {
+      if (abandoned) {
+        throw new DeleteError('E_QUEUE_TIMEOUT', 'The recycle bin was busy; this request was not applied. Retry.', {})
+      }
+      if (aborted()) {
+        throw new DeleteError('E_ABANDONED', 'The client disconnected before this request ran; nothing was changed.', {})
+      }
       // The lock lives in the data dir, which a fresh install has not created
       // yet (the trash store and audit log mkdir their own targets lazily).
       await mkdir(paths.dataDir, { recursive: true }).catch(() => {})
@@ -429,13 +457,39 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         throw error
       }
       try {
+        // Queued behind the lock: the caller may have gone in the meantime.
+        if (aborted()) {
+          throw new DeleteError('E_ABANDONED', 'The client disconnected before this request ran; nothing was changed.', {})
+        }
         return await operation()
       } finally {
         await release()
       }
     })
     mutationChain = next.then(() => undefined, () => undefined)
-    return next
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        abandoned = true
+        reject(
+          new DeleteError(
+            'E_QUEUE_TIMEOUT',
+            'The recycle bin stayed busy for too long; this request was not applied. Retry.',
+            { waitedMs: queueBudgetMs },
+          ),
+        )
+      }, queueBudgetMs)
+      if (typeof timer.unref === 'function') timer.unref()
+      next.then(
+        (value) => {
+          clearTimeout(timer)
+          resolve(value)
+        },
+        (error) => {
+          clearTimeout(timer)
+          reject(error)
+        },
+      )
+    })
   }
 
   function requestId() {
@@ -443,6 +497,20 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     return `dc-${now().toString(36)}-${requestCounter.toString(36)}-${randomBytes(2).toString('hex')}`
   }
 
+  /**
+   * True once the HTTP client has gone away. Mutations consult this before they
+   * touch disk: a request the user cancelled (or a tab that closed) must not
+   * delete a conversation afterwards.
+   */
+  function clientGone(req, res) {
+    if (res?.destroyed === true) return true
+    if (res?.writableEnded === true) return true
+    if (res?.socket && res.socket.destroyed === true) return true
+    if (req?.destroyed === true) return true
+    if (req?.aborted === true) return true
+    return false
+  }
+
   /**
    * Effective batch ceiling for this moment: the configured batch size capped
    * by the remaining per-minute budget. Without this, a batch of 21–50 always
@@ -765,6 +833,11 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
    */
   async function discardEntry(trashId, confirmPhrase) {
     if (typeof trashId !== 'string' || trashId === '') throw new DeleteError('E_BAD_REQUEST', 'A recycle-bin id is required.', {})
+    // Validate before anything joins it into a path. `trash.read` answers null
+    // for a malformed id, which used to fall through to the "directory may
+    // still be on disk" branch below and turn this into an arbitrary-path
+    // existence probe.
+    if (!isTrashId(trashId)) throw new DeleteError('E_BAD_REQUEST', 'The recycle-bin id is malformed.', {})
     if (typeof confirmPhrase !== 'string' || confirmPhrase.trim() !== 'DELETE') {
       throw new DeleteError('E_CONFIRM_PHRASE', 'Type “DELETE” to discard this incomplete entry.', { expected: 'DELETE' })
     }
@@ -869,6 +942,9 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       memoryAdapters: Array.isArray(entry.memory?.adapters) ? entry.memory.adapters : [],
       hasSessionLog: entry.sessionLog !== null && entry.sessionLog !== undefined,
       status: entry.status,
+      // The UI renders buttons from the same predicate the routes enforce, so a
+      // row can no longer offer an action that will be refused.
+      capabilities: entryCapabilities(entry),
       error: entry.error ?? null,
     }
   }
@@ -913,7 +989,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     const parsed = Number.parseInt(String(limit ?? '50'), 10)
     const safe = Number.isFinite(parsed) ? Math.min(Math.max(parsed, 1), 200) : 50
     const result = await audit.tail(safe)
-    return { records: result.records, malformed: result.malformed }
+    // The audit file is on disk in full; the wire copy still must not carry
+    // absolute host paths. `redactDetails` shortens path-like keys and strips
+    // absolute paths out of prose, leaving ids/codes/counts intact.
+    return { records: redactDetails(result.records), malformed: result.malformed }
   }
 
   /**
@@ -1012,7 +1091,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
             : []
         const batchCount = Math.max(1, rawIds.length)
         const lockBudget = Math.min(900_000, 15_000 + batchCount * 16_000 + batchCount * config.liveDrainMs)
-        const result = await serialize(() => deletePlan(body), { lockTimeoutMs: lockBudget })
+        const result = await serialize(() => deletePlan(body), {
+          lockTimeoutMs: lockBudget,
+          shouldAbort: () => clientGone(req, res),
+        })
         // `ok` means "the plan was executed", not "every item succeeded".
         // A partial batch carries `results` + `failures`; marking the whole
         // response as an error hid those results and made the Client show
@@ -1021,17 +1103,26 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return
       }
       if (path === '/trash/restore') {
-        const result = await serialize(() => restoreEntry(body?.trashId), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
+        const result = await serialize(() => restoreEntry(body?.trashId), {
+          lockTimeoutMs: TRASH_LOCK_BUDGET_MS,
+          shouldAbort: () => clientGone(req, res),
+        })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/purge') {
-        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
+        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase), {
+          lockTimeoutMs: TRASH_LOCK_BUDGET_MS,
+          shouldAbort: () => clientGone(req, res),
+        })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/discard') {
-        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
+        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase), {
+          lockTimeoutMs: TRASH_LOCK_BUDGET_MS,
+          shouldAbort: () => clientGone(req, res),
+        })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
@@ -1055,24 +1146,47 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
    * an update or a quit could kill a Host in the middle of a deletion
    * transaction.
    *
-   * The service is probed, not injected: a composition without `connection`
-   * keeps working behind this route's own loopback/origin fence.
+   * The service is probed, not injected. With `requireConnection` (the default)
+   * a composition that has no `connection` service refuses every mutation
+   * instead of silently degrading to the loopback/origin fence alone — that
+   * fence cannot tell one local process from another, so "no connection layer"
+   * means "any process on this machine can delete". Operators who deliberately
+   * run such a composition set `requireConnection: false`.
    */
   const handler = (req, res) => {
     void (async () => {
       const connection = connectionService()
-      if (connection !== undefined && typeof connection.requestRejection === 'function') {
+      const hasConnectionFence = connection !== undefined && typeof connection.requestRejection === 'function'
+      if (!hasConnectionFence && config.requireConnection !== false) {
+        logger.error?.('[conversation-recycle-bin] no connection service; refusing request because requireConnection is enabled')
+        sendJson(res, 401, toWireError(new DeleteError('E_UNAUTHORIZED', 'This Host has no connection layer to authenticate the request; set requireConnection: false to allow it.', {})))
+        return
+      }
+      if (hasConnectionFence) {
         let rejection
         try {
           rejection = connection.requestRejection(req)
-        } catch {
-          rejection = undefined
+        } catch (error) {
+          // Fail closed. A connection layer that throws cannot be read as
+          // "no opinion": letting the request through here would turn any
+          // auth-layer fault into an unauthenticated delete.
+          logger.error?.('[conversation-recycle-bin] connection check failed:', error)
+          sendJson(res, 503, toWireError(new DeleteError('E_INTERNAL', 'The Host could not verify this request.', {})))
+          return
         }
-        if (rejection === 401 || rejection === 403) {
-          const error = rejection === 401
-            ? new DeleteError('E_UNAUTHORIZED', 'This request is not authenticated with the Host.', {})
-            : new DeleteError('E_FORBIDDEN_ORIGIN', 'The Host refused this request at the connection layer.', {})
-          sendJson(res, rejection, toWireError(error))
+        // The documented contract is `401`, `403`, or undefined for "allowed".
+        // Anything else (including a future `503`-style value) is a refusal:
+        // only an explicit absence of a verdict lets the request through.
+        if (rejection !== undefined && rejection !== null) {
+          if (rejection === 401) {
+            sendJson(res, 401, toWireError(new DeleteError('E_UNAUTHORIZED', 'This request is not authenticated with the Host.', {})))
+            return
+          }
+          if (rejection === 403) {
+            sendJson(res, 403, toWireError(new DeleteError('E_FORBIDDEN_ORIGIN', 'The Host refused this request at the connection layer.', {})))
+            return
+          }
+          sendJson(res, 503, toWireError(new DeleteError('E_INTERNAL', 'The Host could not verify this request.', { verdict: rejection })))
           return
         }
       }

package/lib/host/gateway.js

@@ -169,13 +169,27 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
   }
 
   function isLive(sessionId) {
+    // Two independent signals: the in-memory session table, and the agent
+    // registry the Host itself uses to compute a row's `running` flag. A
+    // composition that publishes only `agents` used to look "not live" here,
+    // which skipped quiescing and moved a running conversation's log.
     const sessions = service('sessions')
-    if (sessions === undefined || typeof sessions.get !== 'function') return false
-    try {
-      return sessions.get(sessionId) !== undefined
-    } catch {
-      return false
+    if (sessions !== undefined && typeof sessions.get === 'function') {
+      try {
+        if (sessions.get(sessionId) !== undefined) return true
+      } catch {
+        // fall through to the agent registry
+      }
+    }
+    const agents = service('agents')
+    if (agents !== undefined && typeof agents.get === 'function') {
+      try {
+        if (agents.get(sessionId) !== undefined && agents.get(sessionId) !== null) return true
+      } catch {
+        return false
+      }
     }
+    return false
   }
 
   /**
@@ -279,6 +293,11 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
       const entity = workspace !== null && typeof workspace.sessionIds?.indexOf === 'function'
         ? workspace.sessionIds.indexOf(sessionId)
         : -1
+      // `controller.list()` does not have to carry archive state, and treating
+      // its silence as "not archived" made restore un-hide conversations the
+      // user had archived. The workspace registry is the authoritative record,
+      // so it wins when it knows about the session.
+      const state = await readWorkspaceState()
       return {
         id: sessionId,
         title: projection?.title || fromList?.title || '',
@@ -287,8 +306,8 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
         blank: projection?.blank ?? fromList?.blank ?? false,
         running: fromList?.running ?? false,
         live: isLive(sessionId),
-        archived: fromList?.archived ?? false,
-        pinned: fromList?.pinned ?? false,
+        archived: state.archived.has(sessionId) || fromList?.archived === true,
+        pinned: state.pinned.has(sessionId) || fromList?.pinned === true,
         createdAt: snapshot?.header?.createdAt ?? null,
         updatedAt: fromList?.updatedAt ?? null,
         events: eventCountFor(sessionId, snapshot),

package/lib/host/lifecycle.js

@@ -55,7 +55,13 @@ export function createLifecycleOps({ ctx, gateway, config, now = Date.now, delay
     if (probe !== undefined) return probe === true
     gateway.invalidate()
     const current = await gateway.inspect(sessionId)
-    return current !== null && current.running === true
+    // Gone from every source: nothing left to wait for.
+    if (current === null) return false
+    if (typeof current.running === 'boolean') return current.running
+    // Unknown is NOT "stopped". Treating it that way moved the log out from
+    // under a possibly-running turn; the bounded drain below is what keeps this
+    // from waiting forever, and its refusal rolls the archive back.
+    return true
   }
 
   return {

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.6'
+export const PLUGIN_VERSION = '0.3.8'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",