fix(core): salvage session usage into the history before deleting transcripts

[zjunothing]

What this PR does

Adds a persistUsageBeforeTranscriptDeletion() salvage to usageHistoryService and calls it from SessionService.removeSessionFiles() (both the active and the archived branch) right before the transcript JSONL is unlinked. The salvage replays the transcript's ui_telemetry records through the same summarization the rebuild migration uses — the per-transcript logic is extracted into a shared summarizeTranscript() so the two paths cannot drift — writes the summary to usage_record.jsonl, skips the write when the history already carries a record for that session (a /clear or clean exit wrote the authoritative one; duplicating it would re-open #4994), and never throws, so deletion always proceeds even when salvage fails.

Why it's needed

#7384: token usage per session is persisted to usage_record.jsonl only on /clear and on process exit; for every other session the usage history relies on a rebuild fallback that scans the session transcript JSONLs. removeSessionFiles() deleted those transcripts without persisting anything first — so deleting a session that was never /cleared or cleanly exited (the reporter's screenshot case) permanently erased its token usage from the records, making the usage report inaccurate. The triage confirmed both usage systems from source (the global monthly tokenUsageService files are unaffected; the per-session usageHistoryService is the broken one) and proposed exactly this fix direction.

Reviewer Test Plan

How to verify

1. Run a session (without /clear), kill it uncleanly or just leave it, then delete it from the session list. Before this PR: its tokens vanish from the usage report (the rebuild has no transcript to read). After: the summary — models, token totals, tools, duration — survives in usage_record.jsonl.
2. Delete a session that WAS /cleared: no duplicate record is added (the salvage detects the existing entry and skips).
3. npx vitest run src/services/usageHistoryService.test.ts src/services/sessionService.test.ts (packages/core): 150/150.

Evidence (Before & After)

E2E against the real compiled services under a temp QWEN_HOME: plant a real transcript containing a ui_telemetry record (1000 total tokens), then call the real SessionService.removeSession():

	before fix	after fix
session removed / transcript gone	✅ / ✅	✅ / ✅
usage record for the session	absent — erased forever ❌	present, totalTokens: 1000 ✅

Unit coverage: the salvage writes the summary from real files, skips when the history already has the session, returns false (writing nothing) for telemetry-less transcripts, and never throws for missing files; the sessionService wiring test pins the salvage running before unlinkSync via invocation order and fails on the unpatched source (verified via git stash).

Tested on

OS	Status
🍏 macOS	✅
🪟 Windows	⚠️
🐧 Linux	⚠️

Environment (optional)

macOS (Darwin 24.6), Node v22.23.1; real compiled SessionService/usageHistoryService E2E under a temp QWEN_HOME, plus vitest unit tests. npm run typecheck, eslint --max-warnings 0, prettier all clean.

Risk & Scope

• Main risk or tradeoff: session deletion now reads the transcript once more (a full JSONL read to replay telemetry) plus one read of usage_record.jsonl for the duplicate check — a per-deletion cost bounded by transcript size, on an interactive path where deletion already does multiple file operations. If the current in-progress session were ever deleted, its exit-time persistSessionUsage could still produce a duplicate — bounded by the read side's existing last-wins dedupe (dedupBySessionId, /stats permanently double-counts a session if /stats is opened during the first-ever turn (introduced by #4779) #4994).
• Not validated / out of scope: bulk cleanup paths that bypass removeSessionFiles() (e.g. a user manually deleting ~/.qwen/projects/**) can still lose usage — out of scope, nothing in-process can salvage an external rm. The global monthly tokenUsageService files were never affected.
• Breaking changes / migration notes: none — the salvage is additive and silent.

Linked Issues

Fixes #7384

中文说明

本 PR 做了什么

usageHistoryService 新增 persistUsageBeforeTranscriptDeletion()，并在 SessionService.removeSessionFiles()（active 与 archived 两个分支）删除 transcript JSONL 前调用。salvage 用与重建迁移相同的汇总逻辑重放 transcript 的 ui_telemetry 记录——共用抽取的 summarizeTranscript()，两条路径不会漂移——把摘要写入 usage_record.jsonl；历史中已有该会话记录时跳过（/clear 或正常退出已写权威记录，重复会重开 #4994）；永不抛错，salvage 失败也不阻塞删除。

为什么需要

#7384：会话用量只在 /clear 与进程退出时持久化，其余会话依赖「扫描 transcript 重建」的回退。removeSessionFiles() 删 transcript 前不持久化任何东西——删除一个从未 /clear 或非正常退出的会话（报告者截图场景）会把它的 token 用量从记录中永久抹掉。triage 已从源码确认两套用量系统（全局月度 tokenUsageService 不受影响；受影响的是按会话的 usageHistoryService）并给出了正是本 PR 的修复方向。

审阅测试计划

如何验证

1. 跑一个会话（不 /clear）、直接删除：本 PR 之前其 token 从用量报表消失；之后摘要（模型、token 总量、工具、时长）保留在 usage_record.jsonl；
2. 删除一个已 /clear 的会话：不产生重复记录（salvage 检测到已有条目并跳过）；
3. 两个测试文件 150/150。

证据（Before & After）

对真实编译产物的 E2E（临时 QWEN_HOME 下种入含 1000 tokens 遥测的真实 transcript，再调真实 removeSession()）：修复前会话删除、transcript 消失、用量记录永久缺失；修复后用量记录存活且 totalTokens: 1000。单测覆盖：真实文件写入、已持久化跳过、无遥测不写、缺文件不抛；接线测试用调用顺序钉死「salvage 在 unlink 之前」，在未修复源码上失败（git stash 验证）。

测试平台

macOS 已本地验证（✅）；Windows / Linux 依赖 CI（⚠️）。

环境

macOS（Darwin 24.6）、Node v22.23.1；临时 QWEN_HOME 下的真实编译类 E2E + vitest；typecheck / eslint / prettier 全绿。

风险与范围

• 主要风险/权衡：删除路径多一次 transcript 全量读取（重放遥测）+ 一次 usage_record.jsonl 读取（查重）——按 transcript 大小有界，且删除本就是多文件操作的交互路径。若删除的是进行中的当前会话，退出时的 persistSessionUsage 仍可能产生一条重复——由读侧既有的 last-wins 去重（dedupBySessionId，/stats permanently double-counts a session if /stats is opened during the first-ever turn (introduced by #4779) #4994）兜底。
• 未验证/超出范围：绕过 removeSessionFiles() 的清理（如用户手动 rm ~/.qwen/projects/**）仍会丢用量——进程内无法挽救外部删除，超出范围。全局月度 tokenUsageService 文件从未受影响。
• 破坏性变更/迁移说明：无——salvage 为静默附加行为。

关联 Issue

Fixes #7384

🤖 Generated with Claude Code

[zjunothing]

Verification report

E2E against the real compiled services (temp QWEN_HOME; plant a real transcript with a ui_telemetry record totaling 1000 tokens; call the real SessionService.removeSession()):

	before (origin/main ce803df22)	after (this PR)
removed / transcript gone	✅ / ✅	✅ / ✅
usage record survives	no — erased forever	yes — models['qwen-max'].totalTokens = 1000

Tests (packages/core, 150/150 across the two touched suites):

• salvage writes the summary from real files under QWEN_HOME; skips when usage_record.jsonl already has the session (no /stats permanently double-counts a session if /stats is opened during the first-ever turn (introduced by #4779) #4994 duplicates); returns false and writes nothing for telemetry-less transcripts; never throws for missing files.
• sessionService wiring: removeSession invokes the salvage with the transcript path before unlinkSync (pinned via mock.invocationCallOrder) — fails on the unpatched source (verified via git stash).
• The rebuild path now shares summarizeTranscript() with the salvage; the pre-existing /stats permanently double-counts a session if /stats is opened during the first-ever turn (introduced by #4779) #4994 regression suite still passes unchanged.

Static checks: npm run typecheck ✅ · eslint --max-warnings 0 ✅ · prettier ✅.

Review focus suggestions: (1) ordering — the salvage runs before the first removeFileIfExists in both the active and archived branches, and swallows its own errors so deletion can never be blocked; (2) duplicate policy — skip-if-persisted keeps /clear/exit as the authoritative writers, with the read side's last-wins dedupe as the backstop; (3) the shared summarizeTranscript() refactor preserves rebuild semantics exactly (same seen-session dedupe order, same no-events/NaN-timestamps skips).

中文版本

真实编译产物 E2E（临时 QWEN_HOME 种入含 1000 tokens 遥测的真实 transcript，调真实 removeSession）：修复前用量记录被永久抹掉；修复后存活且 totalTokens=1000。

测试（两套件 150/150）：salvage 真实文件写入 / 已持久化跳过 / 无遥测不写 / 缺文件不抛；接线测试以调用顺序钉死「salvage 在 unlink 之前」，未修复源码上失败（stash 验证）；重建路径与 salvage 共用 summarizeTranscript()，既有 #4994 回归套件原样通过。静态检查全绿。

审阅要点：(1) 顺序——active/archived 两分支都在首个删除前执行 salvage，且自吞错误绝不阻塞删除；(2) 重复策略——已持久化即跳过（/clear/退出仍是权威写入方），读侧 last-wins 去重兜底；(3) summarizeTranscript() 抽取严格保持重建语义（seen-session 去重顺序、无事件/时间戳 NaN 跳过均一致）。

[qwen-code-ci-bot]

Thanks for the PR!

Template looks good ✓

Problem: observed bug with evidence — #7384 reports (with screenshot) that deleting a session permanently erases its token usage from the records. The issue is labeled type/bug / priority/P2 and the triage confirmed the root cause in source.

Direction: aligned. Session deletion should not silently destroy usage data that the user can see in reports. CHANGELOG has no direct reference to usage salvage on delete, but session-deletion data integrity is clearly relevant (multiple upstream fixes around session removal).

Size: 143 production lines (usageHistoryService.ts +98 −39, sessionService.ts +6 −0), 136 test lines. Under the 500-line awareness threshold — no escalation needed.

Approach: the scope feels right — persist before delete, reuse the existing summarization logic via a shared helper, skip when a record already exists, never throw. Every edit serves the stated goal; no unrelated changes. The one design question I'd flag: reading the full transcript JSONL on every deletion adds I/O proportional to transcript size. For very long sessions this could be noticeable, but since deletion is already a multi-file interactive operation and the alternative (losing data permanently) is worse, the tradeoff seems reasonable.

Moving on to code review. 🔍

中文说明

感谢贡献！

模板完整 ✓

问题：已观测到的 bug，有证据——#7384 报告（附截图）删除会话后 token 用量从记录中永久消失。issue 已标记 type/bug / priority/P2，triage 已从源码确认根因。

方向：对齐。删除会话不应静默销毁用户可见的用量数据。CHANGELOG 无直接对应用量抢救条目，但会话删除的数据完整性明确相关（上游有多次会话移除相关修复）。

规模：143 行生产代码（usageHistoryService.ts +98 −39，sessionService.ts +6 −0），136 行测试。低于 500 行关注阈值，无需升级。

方案：范围合理——删前持久化、复用已有汇总逻辑（共享 helper）、已有记录时跳过、永不抛错。所有改动服务于目标，无无关变更。一个设计问题：每次删除都全量读取 transcript JSONL，I/O 与 transcript 大小成正比。超长会话可能有感知，但删除本就是多文件交互操作，且替代方案（永久丢失数据）更糟，权衡合理。

进入代码审查 🔍

— Qwen Code · qwen3.7-max

_{Reviewed at 70723dc4c93580327524ad3da92a43da4e87f547 · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Code review

The approach matches what I'd propose independently: extract the per-transcript summarization from the rebuild migration into a shared summarizeTranscript(), add a persistUsageBeforeTranscriptDeletion() that reads → summarizes → dedup-checks → writes, and wire it into both branches of removeSessionFiles() before the unlink. The refactored rebuild path is behaviorally equivalent to the original (the seenSessionIds dedup moved after telemetry processing — a trivial inefficiency for duplicate sessions, not a correctness change).

No critical blockers found. The code follows project conventions: ESM imports, no any, collocated tests, kebab-case files. The error handling is appropriate — outer try/catch swallows everything so deletion never blocks, and the unreadable-history fallback writes anyway (bounded by read-side dedupBySessionId).

One suggestion (non-blocking): in the active branch of removeSessionFiles(), when a session has both an active file and an archived sidecar (post-compression), only the active file is salvaged — the archived sidecar is deleted without salvage. If telemetry ended up in the archived file after compression, that data would still be lost. This is a narrow edge case (session must have been compressed AND never /clear'd AND never cleanly exited), and the PR is strictly better than the status quo regardless. Worth a follow-up if the maintainer cares about completeness.

Real-scenario testing

Tested against the real compiled SessionService under a temp QWEN_HOME, driving removeSession() on a planted transcript with ui_telemetry records:

=== BEFORE ===
Transcript planted at: /tmp/qwen-salvage-test-mnF6Ms/projects/-tmp-salvage-test-project/chats/a1b2c3d4-e5f6-7890-abcd-ef1234567890.jsonl
Transcript exists: true
usage_record.jsonl exists: false

removeSession result: true

=== AFTER ===
Transcript exists: false
usage_record.jsonl exists: true
--- Salvaged usage record ---
  sessionId: a1b2c3d4-e5f6-7890-abcd-ef1234567890
  project: /tmp/salvage-test-project
  models: {"qwen-max":{"requests":1,"inputTokens":800,"outputTokens":400,"cachedTokens":0,"thoughtsTokens":200,"totalTokens":1400,"totalLatencyMs":1200}}
  durationMs: 60000

Dedup test (session already has a usage record from /clear or clean exit):

=== BEFORE ===
Transcript exists: true
usage_record.jsonl lines: 1

removeSession result: true

=== AFTER ===
Transcript exists: false
usage_record.jsonl lines: 1
PASS: No duplicate record created (dedup works)

Unit tests: 150/150 pass (usageHistoryService.test.ts 30 tests, sessionService.test.ts 120 tests).

中文说明

代码审查

方案与我的独立提案一致：将重建迁移中的逐 transcript 汇总逻辑抽取为共享的 summarizeTranscript()，新增 persistUsageBeforeTranscriptDeletion()（读取 → 汇总 → 查重 → 写入），并在 removeSessionFiles() 的两个分支中于 unlink 前调用。重构后的重建路径与原始行为等价（seenSessionIds 去重移到了遥测处理之后——对重复会话有微小效率差异，非正确性问题）。

未发现关键阻塞项。代码遵循项目规范：ESM 导入、无 any、测试共置、kebab-case 文件名。错误处理恰当——外层 try/catch 吞掉所有异常确保删除不被阻塞，历史不可读时仍写入（由读侧 dedupBySessionId 兜底）。

一个建议（非阻塞）：在 removeSessionFiles() 的 active 分支中，当会话同时有 active 文件和 archived 副本（压缩后）时，只抢救了 active 文件——archived 副本被直接删除未抢救。如果遥测在压缩后落入了 archived 文件，那部分数据仍会丢失。这是很窄的边界情况（会话必须被压缩过且从未 /clear 且非正常退出），且无论如何 PR 都严格优于现状。如果 maintainer 关注完整性，可以后续跟进。

真实场景测试

对真实编译产物 SessionService 在临时 QWEN_HOME 下测试，驱动 removeSession() 删除种入 ui_telemetry 记录的 transcript：修复前 transcript 存在、无 usage_record；修复后 transcript 已删、usage_record 已创建且数据正确（sessionId、project、models token 计数、durationMs）。去重测试：已有记录的会话删除后不产生重复。单测 150/150 全通过。

— Qwen Code · qwen3.7-max

_{Reviewed at 70723dc4c93580327524ad3da92a43da4e87f547 · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Confidence: 4/5

This is a clean, well-scoped fix for a real data-loss bug. The shared summarizeTranscript() extraction prevents drift between the rebuild and salvage paths, the dedup guard avoids re-opening #4994, and the never-throw contract keeps deletion reliable. E2E testing confirms both the salvage and dedup behaviors against the real compiled services. 150/150 unit tests pass.

The one-point deduction is for the archived-sidecar gap noted in Stage 2 — a narrow edge case that doesn't block this PR but is worth a follow-up.

LGTM, approving. ✅

中文说明

置信度：4/5

这是一个干净、范围合理的修复，解决了真实的数据丢失 bug。共享的 summarizeTranscript() 抽取防止了重建与抢救路径的漂移，去重守卫避免重开 #4994，永不抛错的契约保证删除可靠性。E2E 测试在真实编译产物上确认了抢救和去重行为。150/150 单测全通过。

扣一分是因为 Stage 2 提到的 archived 副本缺口——很窄的边界情况，不阻塞本 PR，但值得后续跟进。

LGTM，批准。✅

— Qwen Code · qwen3.7-max

_{Reviewed at 70723dc4c93580327524ad3da92a43da4e87f547 · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

LGTM, looks ready to ship. ✅

[doudouOUC]

Reviewed. Suggestions are inline. 1 Suggestion-level finding(s) could not be anchored to a changed line and were dropped; nothing further to act on here.

— qwen3.7-max via Qwen Code /review

[doudouOUC]

[Suggestion] No test exercises the failure-tolerant deletion contract — Concrete cost: the code comment at sessionService.ts:1345 documents "Never blocks deletion (the salvage swallows its own errors)", but the mock always resolves true, so no test verifies that deletion proceeds when salvage fails. A future refactor that accidentally makes removeSessionFiles depend on salvage success would go undetected.

Suggested change

	const salvage = vi.mocked(persistUsageBeforeTranscriptDeletion);
	expect(salvage).toHaveBeenCalledWith(
	expect.stringContaining(`${sessionIdA}.jsonl`),
	salvage.mockResolvedValueOnce(false);
	const result = await sessionService.removeSession(sessionIdA);
	expect(result).toBe(true);
	expect(unlinkSyncSpy).toHaveBeenCalled();

— qwen3.7-max via Qwen Code /review

[zjunothing]

Addressed in follow-up #7425 — and running your suggested case exposed that the contract was NOT actually structural: a rejecting salvage propagated through removeSessionFiles' rethrowing catch and failed the deletion. The follow-up adds a call-site salvageUsageBestEffort wrapper (catch + warn) plus the failure-tolerance test, which fails without the wrapper. 中文：已在 follow-up #7425 落地——按建议补测试时发现契约此前并非结构性（rejection 会穿透重抛 catch 使删除失败），已加调用点包装 + 失败容忍测试（无包装即失败）。

[doudouOUC]

[Suggestion] Ordering assertion is fragile due to uncleared module mock — Concrete cost: persistUsageBeforeTranscriptDeletion is a vi.mock() at module scope and its invocationCallOrder accumulates across all tests. afterEach calls vi.restoreAllMocks() which only restores spies, not module mocks. Currently this test is first in the describe block so [0] works, but reordering tests or adding an earlier test that triggers the active path would make [0] reference a stale call — and the assertion would silently pass for the wrong reason since invocationCallOrder is monotonically increasing.

Suggested change

	expect(salvage.mock.invocationCallOrder[0]!).toBeLessThan(
	unlinkSyncSpy.mock.invocationCallOrder[0]!,
	);
	// Add to beforeEach:
	vi.mocked(persistUsageBeforeTranscriptDeletion).mockClear();
	expect(salvage.mock.invocationCallOrder[0]!).toBeLessThan(
	unlinkSyncSpy.mock.invocationCallOrder[0]!,
	);

— qwen3.7-max via Qwen Code /review

[zjunothing]

Addressed in follow-up #7425 — the salvage module mock is now cleared in the top-level beforeEach, so invocationCallOrder assertions can never read stale calls regardless of test ordering. 中文：已在 #7425 落地——顶层 beforeEach 清理该模块 mock，顺序断言不再受测试重排影响。

[qwen-code-ci-bot]

Reviewed — no blockers. Suggestions are inline.

— qwen3.7-max via Qwen Code /review

[qwen-code-ci-bot]

[Suggestion] Missing usage salvage for the archived transcript when both active and archived co-exist — Failure scenario: if both files exist for the same sessionId (e.g., an interrupted archive left both in place) and the active transcript has no telemetry events (a fresh session started after archiving), the active salvage writes nothing, then the archived transcript — which holds the session's historical usage data — is deleted without salvage. That usage data is permanently lost from usage_record.jsonl.

Adding the same salvage call before the archived deletion is safe: the dedup guard in persistUsageBeforeTranscriptDeletion returns false when the active salvage already wrote a record for this sessionId, and when the active salvage didn't write, the archived salvage preserves the data.

Suggested change

	await persistUsageBeforeTranscriptDeletion(activePath);
	this.removeFileIfExists(activePath);
	const archivedPath = this.getSessionFilePath(sessionId, 'archived');
	if (fs.existsSync(archivedPath)) {
	await persistUsageBeforeTranscriptDeletion(activePath);
	this.removeFileIfExists(activePath);
	const archivedPath = this.getSessionFilePath(sessionId, 'archived');
	if (fs.existsSync(archivedPath)) {
	await persistUsageBeforeTranscriptDeletion(archivedPath);

— qwen3.7-max via Qwen Code /review

[zjunothing]

Addressed in follow-up #7425 — the active branch now salvages the archived transcript before removing it, exactly per your reasoning: the dedup guard makes it a no-op when the active copy already wrote, and it preserves the history when the fresh active copy has no telemetry. 中文：已在 #7425 落地——active 分支删除 archived 副本前也执行 salvage；查重门保证 active 已写时为 no-op，active 无遥测时保住历史数据。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wenshao]

Local verification — built and tested against the real compiled services ✅

I built the core package and ran a real end-to-end test against the compiled SessionService + usageHistoryService (no mocks) under a throwaway QWEN_HOME. I reproduced the bug on the pre-fix build and confirmed the fix on this PR's build — same script, two compiled dist/ outputs.

What I ran

• Rebuilt @qwen-code/qwen-code-core dist/ twice — at this PR's head and at its parent commit (HEAD^, i.e. the exact pre-fix state) — and ran the same E2E against each compiled build. (I deliberately diffed against HEAD^, not the current origin/main, since main has drifted 104 commits and its Storage constructor no longer matches this branch.)
• E2E: plant a real transcript containing a ui_telemetry record, call the real SessionService.removeSession(), then check whether the per-session usage summary survives in usage_record.jsonl.

Before / after (real compiled dist, temp QWEN_HOME)

After removeSession() deletes the transcript	before fix (HEAD^)	after fix (this PR)
session removed / transcript gone	✅ / ✅	✅ / ✅
usage record in usage_record.jsonl	absent — erased forever ❌	present ✅
salvaged tokens — active branch (planted 1000)	—	totalTokens: 1000 ✅
salvaged tokens — archived branch (planted 2000)	—	totalTokens: 2000 ✅

Both the active and archived branches of removeSessionFiles() salvage correctly — I exercised each one end-to-end through the real removeSession().

Unit tests + adversarial guard

• vitest run usageHistoryService.test.ts sessionService.test.ts → 150 / 150.
• Adversarial check: I paired the PR's patched wiring test with unpatched source. The removeSession salvage assertion fails with Number of calls: 0, so the test genuinely pins the salvage running before unlinkSync — it is not a no-op that would pass regardless.

Gates (on the 4 changed files)

• tsc --noEmit → exit 0
• eslint --max-warnings 0 → clean (the CI Test job gates on this before vitest)
• prettier --check → clean

Verdict

LGTM from my side. The change is tightly scoped (4 files, additive), the salvage swallows its own errors so deletion can never be blocked, and the dedupe-by-sessionId guard avoids re-opening #4994. The documented residual costs — one extra transcript read + one usage_record.jsonl read per deletion, and a possible single duplicate if the in-progress session is deleted (bounded by the read-side last-wins dedupBySessionId) — are acceptable on this interactive path. External rm of ~/.qwen/projects/** remains out of scope and unsalvageable, as the PR states.

中文说明

本地验证 —— 针对真实编译产物构建并测试 ✅

我在本地构建了 core 包，并在临时 QWEN_HOME 下对编译后的 SessionService + usageHistoryService（非 mock）跑了真实的端到端测试：在修复前的产物上复现了 bug，在本 PR 的产物上确认了修复 —— 同一份脚本，两份编译 dist/。

（截图见上方英文部分。）

我做了什么

• 把 @qwen-code/qwen-code-core 的 dist/ 构建了两次 —— 一次在本 PR 的 head，一次在其父提交（HEAD^，即修复前的确切状态）—— 用同一个 E2E 分别打这两份编译产物。（我特意对比 HEAD^ 而非当前 origin/main：main 已领先 104 个提交，其 Storage 构造函数签名已与本分支不一致。）
• E2E：种入一份含 ui_telemetry 记录的真实 transcript，调用真实的 SessionService.removeSession()，再检查按会话的用量摘要是否存活于 usage_record.jsonl。

Before / after（真实编译 dist，临时 QWEN_HOME）

removeSession() 删除 transcript 之后	修复前（HEAD^）	修复后（本 PR）
会话删除 / transcript 消失	✅ / ✅	✅ / ✅
usage_record.jsonl 中的用量记录	缺失 —— 永久抹除 ❌	存在 ✅
挽救的 token —— active 分支（种入 1000）	—	totalTokens: 1000 ✅
挽救的 token —— archived 分支（种入 2000）	—	totalTokens: 2000 ✅

removeSessionFiles() 的 active 与 archived 两个分支都能正确挽救 —— 我分别通过真实的 removeSession() 端到端跑过。

单测 + 反向校验

• vitest run usageHistoryService.test.ts sessionService.test.ts → 150 / 150。
• 反向校验：我用本 PR 的已修复接线测试搭配未修复源码，removeSession 的 salvage 断言以 Number of calls: 0 失败 —— 说明该测试确实钉死了「salvage 在 unlinkSync 之前执行」，不是一个无论如何都会通过的空测试。

门禁（针对 4 个改动文件）

• tsc --noEmit → exit 0
• eslint --max-warnings 0 → 干净（CI 的 Test job 在 vitest 之前会卡这一关）
• prettier --check → 干净

结论

我这边 LGTM。改动范围很收敛（4 个文件、纯附加），salvage 自吞异常、绝不阻塞删除，按 sessionId 去重的守卫也避免了重开 #4994。已记录的残余成本 —— 每次删除多一次 transcript 读取 + 一次 usage_record.jsonl 读取，以及删除进行中当前会话时可能产生一条重复（由读侧 last-wins 的 dedupBySessionId 兜底）—— 在这条交互路径上可以接受。绕过进程、直接 rm ~/.qwen/projects/** 仍属超范围且无法挽救，正如 PR 所述。

---

🤖 Generated with Claude Code — Claude Fable 5

[qwen-code-ci-bot]

Released in v0.20.1.

[yiliang114]

⚠️ Failed to process this request. Please re-mention the bot to retry.