会话列表 session/list 是 fail-closed 的全量扫描：一个脏目录就让整张列表消失（「历史 session 不见了」）

① 列表是一次全量扫描，成本 O(盘上全部会话)

实测一次真实调用：2957 行 / 1.28 MB / 9.7–11.9 秒。链路是 session/list → sessionQuery.listSessions() → persistence.list() → listArtifacts()：逐个项目目录（workspace slug）、逐个会话目录 readdir，再解压每个会话日志首帧读 header，最后把所有会话（含 origin=subagent，前端并不渲染）序列化给浏览器。没有分页、没有 limit、没有缓存。

② 这条链路是 fail-closed：一个脏目录 = 全部工作区的全部会话一起消失

listArtifacts() 的 catch 里只放过 SessionFormatUnsupportedError，其余一律 throw。而同一个函数往下三行，header 解不出来却是 if (header === void 0) continue（只跳那一行）；同一个仓另一处也早就 fail-soft（api-session.list: projection column ... failed; serving the row without it）。也就是说：这里的「宁可整张列表不发」既不一致、也不是有意为之的取舍。

③ 一次性的编码检查失败会被进程缓存，重启前不可恢复

ensureRootEncoding() 用的是 this.rootEncodingCheck ??= this.checkRootEncoding()：rejected 的 promise 也被 ??= 记住。一次瞬时或一次性的「同目录混用两种压缩编码」状态，会让该进程此后每次列表都失败，直到 systemctl restart。这在「本地 CLI、进程短命」的假设下无所谓；在 7×24 长驻的 Web 服务上就是缺陷。

oracle（BUGGY vs PATCHED 双跑）

node ops/dsh/upstream-issue-session-list-scan/selftest.mjs
# -> SELFTEST PASS, exit 0

它证明四件事：(1) 七类脏状态在 BUGGY 下各自都让整张列表抛（0 行可见）；(2) PATCHED 下只消失那一行，并恰好多出一条指名路径的告警，其余 5 条照常渲染；(3) ensureRootEncoding 的失败在 BUGGY 里粘住整个进程（脏文件清掉后再调仍然拒绝），PATCHED 立即恢复；(4) 成本形状：无 limit 时列出 200 行要走遍 200 个目录，带 limit=50 的服务端实现只走 50 个。

补丁（最小三处，已在随包文件上验过可应用、可解析）

cat   ops/dsh/upstream-issue-session-list-scan/upstream-session-list-fail-soft.patch
#     git apply --check ...   # 对 node_modules/@deepseek-ai/dsh-session-persistence-jsonl/lib/index.js
#     node --check ...        # 打完补丁的文件语法仍合法（我们两个都跑过）

三处改动：① listSessionDirs()：项目目录下的平铺 legacy 文件告警 + 忽略，不再为它把整个根抛掉（它天然在「按目录兜底」的范围之外——这是 oracle 反过来纠了补丁设计的一处）；② listArtifacts()：按目录 try/catch，出错目录跳这一行 + 告警指名路径，SessionFormatUnsupportedError 保持静默跳过、abort 信号照旧生效；③ ensureRootEncoding()：只缓存成功，失败即丢弃。

Title: Session listing is fail-closed: one bad session directory empties the
       entire `session/list` result (and the failed encoding check is cached
       for the process lifetime)

Summary
-------
`session/list` — the Web sidebar's only data source — is served by
`JsonlSessionPersistence#listArtifacts()`, which walks every project directory
and every session directory under the sessions root and decompresses each log's
first frame to read its header. The walk is fail-closed: any ONE of the
following aborts the WHOLE listing, so the client renders the workspace with
zero sessions (user report: "my history is gone") until a later attempt
happens to succeed:

  * a flat `.jsonl`/`.jsonl.zstd` file directly under a project directory
    (`listSessionDirs()` throws legacyLayout);
  * an opposite-encoding artifact, e.g. `session.v3.jsonl` beside the canonical
    `session.v3.jsonl.zstd` (`resolveGenerationInDirectory()` throws
    encodingMismatch);
  * a filename generation disagreeing with the header `version`;
  * a header whose `id`/`cwd` do not name the path it sits at (a missing `cwd`
    reads as `_no-cwd` and is equally fatal);
  * a retired policy field in the header (`sandboxMode`/`approvalPolicy`);
  * the same header id claimed by two project directories
    (`duplicate JSONL session id ...`).

The same function already treats an unparsable first line as a skippable row
(`if (header === void 0) continue`), and the API layer already degrades
projection columns with "serving the row without it" — so failing the whole
listing here is inconsistent with the module's own behaviour.

Aggravating factors
-------------------
1. `ensureRootEncoding()` uses `this.rootEncodingCheck ??= this.checkRootEncoding()`.
   A REJECTED promise is cached too, so one transient or one-shot encoding
   mismatch keeps every subsequent listing of that process failing until the
   service is restarted.

2. `session/list` takes no cursor and no limit, so it is O(all sessions on
   disk) on every call. Measured on a real deployment: 2957 rows / 1.28 MB /
   9.7–11.9 s; the same instance measured 1.9 s a few hours later with the same
   data, i.e. load-dependent. 2824 of those sessions are `origin=subagent`
   children the sidebar never renders, and they grow ~70/day. Note the ACP
   surface already has a keyset cursor for `session/list`
   (`decodeSessionListCursor` / `isAfterSessionListCursor`), and
   `dsh-session-query-sqlite` already maintains a
   `persisted_sessions(id, revision, generation)` derived index that the
   listing path does not use.

Requested behaviour
-------------------
  * Fail-soft per session directory: skip it and log a warning naming the
    path, consistent with the existing skips in the same function and with
    "serving the row without it" in the projection columns.
  * Do not cache a failed root-encoding check.
  * Consider `limit`/`cursor` for the Web `session/list` (reusing the ACP
    keyset cursor) and/or serving the listing from `persisted_sessions`.

Reproduction
------------
A dependency-free oracle modelling the shipped control flow under BUGGY and
PATCHED covers all seven poison kinds, the sticky encoding check, and the cost
shape; a three-hunk minimal patch (verified to apply to and parse against the
published `lib/index.js` of 0.1.5-rc.1 and 0.1.5-rc.2, which are byte-identical
in this file) accompanies it. Related: the earlier report that the same RPC can
hang without ever returning a byte on a unary path.

Versions: reproduced against @deepseek-ai/dsh 0.1.5-rc.1 (latest) and checked
against 0.1.5-rc.2 (next) — no change in the two packages involved.