Summary

• Hide conflict-recovery copies from the normal topic list and stop showing the recovery badge/title as a regular conversation. Recovery keeps the original topic; copies stay reachable from History and are marked as conflict copies in the session tree and History drawer.
• Add an append-only session event log with a compatibility checkpoint: normal saves append, while explicit rewrites remain versioned events.
• Make the event log crash-safe and bounded: torn tails left by a crash or full disk are truncated by the next save instead of failing LoadSession; replace events and checkpoint rewrites are fsynced; past a size threshold the log compacts to a single replace event and the .jsonl checkpoint is refreshed, so direct readers and older binaries stay bounded-stale instead of frozen at first save.
• Never touch files the native layer does not own: a legacy v0.x .events.jsonl transcript sitting at the native log path is read-ignored and preserved byte-for-byte; logs written by a newer schema fail loudly instead of being silently truncated.
• Keep one-shot saves single-file: force saves (subagents, guardian, migrations, forks) never bootstrap an event log and fold an existing one into a single replace event.
• Sweep the event log/index from every deletion surface through store.SessionSidecarFiles — /clear, serve delete, ACP delete, subagent delete, and desktop trash — so deleted conversations can neither leak on disk nor be resurrected by LoadSession.
• Move session discovery and artifact lifecycle onto the centralized session filename helpers; guardian sidecars are excluded from transcript discovery.
• Clean up stale lease metadata, session lock sidecars, and orphan display entries during safe desktop cleanup paths. Desktop trash/delete now refuses to touch a session whose lease is held by another live process, preserving cross-process mutual exclusion.
• Migrate checkpoint-only readers to event-aware APIs: prompt history (↑ recall), the serve session list, automatic topic titles, duplicate-trash comparison, history search recency, and doctor byte totals.
• Count recovery-copy activity in topic summaries (recency, unread, time filters) without double-counting turns, and hide recovery-only topics only when they are unpinned with no live runtime session.

Context

This addresses the recovery-chain and stale artifact behavior discussed around #5940, #5947, and #5960. It does not claim to fix an unrelated process crash without a concrete crash log; it reduces the recovery cascade surface, makes the authoritative transcript tolerant of the crashes that used to trigger cascades, and prevents leftover lock/display/log sidecars from accumulating through the built-in cleanup and delete flows.

Verification

• go test -p 1 ./...
• go test . from desktop/
• pnpm --dir desktop/frontend typecheck
• pnpm --dir desktop/frontend check:css
• git diff --check
• New regression coverage: torn-tail self-heal, foreign/legacy log read-ignore (boot migration end-to-end), future-schema rejection, broken append chains, concurrent load-during-append, compaction growth bound, force-save single-file semantics, deletion sweeps on all five surfaces asserting no resurrection via LoadSession, external-lease trash guard, event-aware prompt history / serve list / auto titles, duplicate-trash content comparison, and the recovery-only topic hiding matrix.