fix(chat): make archive restore safe, and cap what one page paints

Follow-ups to the session-loss and long-session fixes:

- Restoring archived messages is now a menu action with a count, not dead
  code and not an automatic reload. It slots rows back by created_at
  instead of appending them after everything typed since, and it retires
  only the rows it restored — the session-wide archive wipe was deleting
  the pre-edit history of messages that are still live.
- Deleting from an assistant reply anchors on the visible user bubble,
  including an image-only prompt. Skipping it because its text is empty
  cut the previous turn as well.
- The "load older" fallback and the split-turn prefix share the cold-open
  row cap. One tap no longer materialises every earlier row, and one huge
  tool turn can no longer undo the render window.
- Chat image thumbnails, the fullscreen preview and the composer chip
  decode through the display-size ceiling the markdown renderer already
  uses. The OOM was per-bitmap, not per-row.

Author: tall-1997

src/android/app/src/main/java/com/openminis/app/data/db/ChatDao.kt

@@ -83,6 +83,13 @@ data class MessageSortAnchor(
     val role: String,
 )
 
+/** (id, created_at, sort_order) — the meta archive restore reorders by. */
+data class MessageSortMetaRow(
+    val id: String,
+    @ColumnInfo(name = "created_at") val createdAt: Long,
+    @ColumnInfo(name = "sort_order") val sortOrder: Int,
+)
+
 data class MessagePreviewRow(
     val role: String,
     val preview: String?,
@@ -646,6 +653,17 @@ interface ChatDao {
     @Query("SELECT sort_order FROM messages WHERE id = :id")
     suspend fun sortOrderForMessageId(id: String): Int?
 
+    /** Meta-only projection for [ChatRepository.restoreArchivedVersions]. */
+    @Query(
+        "SELECT id, created_at, sort_order FROM messages " +
+            "WHERE session_id = :sessionId ORDER BY sort_order ASC"
+    )
+    suspend fun sortMetaForSession(sessionId: String): List<MessageSortMetaRow>
+
+    /** Rewrites one row's sequence slot. Used by the restore re-insertion. */
+    @Query("UPDATE messages SET sort_order = :sortOrder WHERE id = :id")
+    suspend fun updateSortOrder(id: String, sortOrder: Int)
+
     // [T-error-persist-android] Write/clear the terminal error sticker on a
     // specific message row by id. Used when the persisted DB id is known
     // (clear-on-retry via sourceDbIds).

src/android/app/src/main/java/com/openminis/app/data/db/MessageVersionDao.kt

@@ -37,6 +37,22 @@ interface MessageVersionDao {
     )
     suspend fun versionsForSession(sessionId: String): List<MessageVersionEntity>
 
-    @Query("DELETE FROM message_versions WHERE session_id = :sessionId")
-    suspend fun deleteForSession(sessionId: String): Unit
+    /**
+     * Message ids whose every archived version has no live row left — the
+     * candidates a restore may put back. Counts DISTINCT message ids, not
+     * version rows: one message can carry several archived versions.
+     */
+    @Query(
+        "SELECT DISTINCT message_id FROM message_versions WHERE session_id = :sessionId " +
+            "AND message_id NOT IN (SELECT id FROM messages WHERE session_id = :sessionId)"
+    )
+    suspend fun restorableMessageIds(sessionId: String): List<String>
+
+    /**
+     * Retires specific archive rows after they were restored. NEVER delete by
+     * session: [message_versions] doubles as the pre-edit history of live
+     * rows, and wiping the session's archive destroyed exactly that history.
+     */
+    @Query("DELETE FROM message_versions WHERE id IN (:ids)")
+    suspend fun deleteByIds(ids: List<String>)
 }

src/android/app/src/main/java/com/openminis/app/data/repository/ChatRepository.kt

@@ -850,20 +850,39 @@ class ChatRepository(
         )
 
     /**
-     * [T-msg-version-restore] One-shot recovery for rows lost to the
-     * 2026-10-14 ordinal-mismatch truncation (deleteMessagesAfter anchored
-     * dozens of turns early; 1386 rows were archived then deleted from one
-     * retry tap). Re-inserts every archived version whose source row no
-     * longer exists in `messages`, at sort orders ABOVE the current tail so
-     * the live conversation is untouched, and deletes the restored rows from
-     * `message_versions` so a second call is a no-op.
+     * How many deleted messages the local archive could still put back
+     * (messages with archived versions and no live row). Powers the manual
+     * restore confirmation.
+     */
+    suspend fun restorableArchivedMessageCount(sessionId: String): Int {
+        val vdao = versionDao ?: return 0
+        return runCatching { vdao.restorableMessageIds(sessionId).size }.getOrDefault(0)
+    }
+
+    /**
+     * [T-msg-version-restore] Recovery for rows lost to a truncation whose
+     * cutoff landed too early (the 2026-10-14 ordinal-mismatch incident:
+     * 1386 rows archived then deleted from one retry tap). Re-inserts every
+     * archived version whose source row no longer exists in `messages`.
      *
-     * Only LATEST versions are restored (highest version_index per
-     * message_id): earlier versions are the pre-edit history the archive
-     * exists to keep, not rows to resurrect.
+     * Contract:
+     *  - CHRONOLOGY is rebuilt, not appended: restored rows slot back where
+     *    their created_at places them (see [chronologicalRestoreOrder]), so
+     *    old messages never land after messages the user typed since.
+     *  - Only the RESTORED archive rows are retired afterwards. The session's
+     *    other versions are the pre-edit history of LIVE rows — the reason
+     *    the archive exists — and deleting the whole session archive here
+     *    (the old behaviour) destroyed exactly that history.
+     *  - INVOKED EXPLICITLY by the user ("restore deleted messages"), never
+     *    automatically on session load: a truncation is also how a retry or
+     *    an intentional delete discards content, and silently resurrecting it
+     *    would overrule the user. The confirmation dialog states what the
+     *    archive still holds.
      *
-     * Idempotent: rows whose message_id still exists in `messages` are
-     * skipped (their live row already carries the content).
+     * Only LATEST versions are restored (highest version_index per
+     * message_id): earlier versions are pre-edit history, not rows to
+     * resurrect. Rows whose message_id still exists live are skipped, so a
+     * repeat call after the first restore is a no-op.
      */
     suspend fun restoreArchivedVersions(sessionId: String): RestoreResult {
         val vdao = versionDao ?: return RestoreResult(0, 0, "versionDao unavailable")
@@ -886,33 +905,59 @@ class ChatRepository(
         val toRestore = latest.filter { it.messageId !in existingIds }
         if (toRestore.isEmpty()) return RestoreResult(0, all.size, null)
 
-        // Append above the current tail, preserving source order.
-        var nextSort = dao.nextSortOrder(sessionId)
-        val restored = mutableListOf<MessageEntity>()
-        for (v in toRestore) {
-            val row = MessageEntity(
-                id = v.messageId,
-                sessionId = sessionId,
-                role = v.role,
-                partsJson = v.partsJson ?: "[]",
-                createdAt = v.sourceCreatedAt,
-                sortOrder = nextSort,
-                reasoningContent = v.reasoningContent,
-                errorInfo = v.errorInfo,
-                modelId = v.modelId,
-                modelDisplayName = v.modelDisplayName,
-                bodyRef = v.bodyRef,
-                bodySha = v.bodySha,
+        // [T-msg-version-restore] Re-insert by CHRONOLOGY, not at the tail.
+        // A truncation removes a span from the middle; appending restored rows
+        // after everything the user typed since reads as old messages arriving
+        // after new ones. Rebuild the sequence from (created_at, live-first)
+        // order and renumber in one transaction: two passes over the live rows
+        // (first to a scratch range, then into the final slot) so the unique
+        // (session_id, sort_order) index never sees two rows claiming the same
+        // slot mid-flight.
+        val restoredById = toRestore.associateBy { it.messageId }
+        val restoredArchiveIds = toRestore.map { it.id }
+        val apply: suspend () -> List<MessageEntity> = {
+            val meta = dao.sortMetaForSession(sessionId)
+            val order = chronologicalRestoreOrder(
+                existing = meta.map { SortEntry(it.id, it.createdAt) },
+                restored = toRestore.map {
+                    SortEntry(it.messageId, it.sourceCreatedAt, restored = true)
+                },
             )
-            dao.insertMessage(row)
-            restored.add(row)
-            nextSort++
-        }
-        // Remove the restored entries from the archive so a repeat call is a
-        // no-op (the live row now carries the content).
-        runCatching {
-            vdao.deleteForSession(sessionId)
+            val scratchBase = order.size + 1_000_000
+            meta.forEachIndexed { index, row ->
+                dao.updateSortOrder(row.id, scratchBase + index)
+            }
+            val restoredRows = mutableListOf<MessageEntity>()
+            order.forEachIndexed { index, entry ->
+                if (entry.restored) {
+                    val v = restoredById.getValue(entry.id)
+                    val row = MessageEntity(
+                        id = v.messageId,
+                        sessionId = sessionId,
+                        role = v.role,
+                        partsJson = v.partsJson ?: "[]",
+                        createdAt = v.sourceCreatedAt,
+                        sortOrder = index,
+                        reasoningContent = v.reasoningContent,
+                        errorInfo = v.errorInfo,
+                        modelId = v.modelId,
+                        modelDisplayName = v.modelDisplayName,
+                        bodyRef = v.bodyRef,
+                        bodySha = v.bodySha,
+                    )
+                    dao.insertMessage(row)
+                    restoredRows.add(row)
+                } else {
+                    dao.updateSortOrder(entry.id, index)
+                }
+            }
+            // Retire ONLY the restored archive rows — the session's remaining
+            // versions are live pre-edit history and must survive.
+            vdao.deleteByIds(restoredArchiveIds)
+            restoredRows
         }
+        val dbRef = db
+        val restored = if (dbRef != null) dbRef.withTransaction { apply() } else apply()
         AppLogger.info(
             TAG,
             "[T-msg-version-restore] restored ${restored.size} rows to session " +
@@ -927,6 +972,16 @@ class ChatRepository(
         val error: String?,
     )
 
+    /**
+     * One slot in a restored transcript. [restored] rows come from the
+     * archive; the rest are live rows being renumbered around them.
+     */
+    internal data class SortEntry(
+        val id: String,
+        val createdAt: Long,
+        val restored: Boolean = false,
+    )
+
     /**
      * Rewrite a single message row's parts_json in place. Used by
      * [com.openminis.app.ui.chat.ChatViewModel.rerunFromToolBlock]'s block-
@@ -1438,6 +1493,22 @@ class ChatRepository(
     companion object {
         private const val TAG = "ChatRepository"
 
+        /**
+         * Merge live rows and restored rows back into one timeline.
+         *
+         * Order is created_at ascending. A restored row and a live row that
+         * share a timestamp keep the LIVE row first: a retry that re-persists
+         * the same user turn gets a new id and a later-or-equal created_at,
+         * and the restored predecessor must not jump ahead of the turn the
+         * user actually kept.
+         */
+        internal fun chronologicalRestoreOrder(
+            existing: List<SortEntry>,
+            restored: List<SortEntry>,
+        ): List<SortEntry> = (existing + restored).sortedWith(
+            compareBy<SortEntry> { it.createdAt }.thenBy { it.restored },
+        )
+
         /**
          * Upper bound for one authoritative context hydrate. The UI remains
          * tail-windowed, but model context must be able to recover history

src/android/app/src/main/java/com/openminis/app/ui/chat/ChatComposerWidgets.kt

@@ -66,6 +66,8 @@ import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.ui.unit.sp
 import coil.compose.AsyncImage
+import coil.request.ImageRequest
+import com.openminis.app.ui.DisplayBitmapLimits.limitDisplaySize
 import com.openminis.app.data.model.ThinkingLevel
 import com.openminis.app.R
 import com.openminis.app.ui.theme.ChatColors
@@ -104,7 +106,10 @@ internal fun AttachmentChip(
         ) {
             if (attachment.isImage) {
                 AsyncImage(
-                    model = attachment.uri,
+                    model = ImageRequest.Builder(LocalContext.current)
+                        .data(attachment.uri)
+                        .limitDisplaySize()
+                        .build(),
                     contentDescription = attachment.fileName,
                     modifier = Modifier
                         .matchParentSize()

src/android/app/src/main/java/com/openminis/app/ui/chat/ChatHistoryPaging.kt

@@ -87,7 +87,20 @@ internal suspend fun ChatViewModel.loadSplitTurnPrefix(beforeSortOrder: Int): Li
     // Complete the cut turn before painting the cold-open tail. The probe
     // reads only role + sort_order, so a long tool turn does not parse bodies
     // merely to find its boundary.
-    val start = olderTurnStart(beforeSortOrder, turnCount = 1) ?: return emptyList()
+    //
+    // The prefix is capped at the same ceiling as the cold-open tail. A tool
+    // turn can itself be thousands of rows; completing it unbounded would
+    // undo the render-window cap the moment a page boundary lands inside one.
+    // What does not fit stays above the window and comes back through
+    // loadOlderMessages.
+    val rawStart = olderTurnStart(beforeSortOrder, turnCount = 1) ?: return emptyList()
+    if (rawStart >= beforeSortOrder) return emptyList()
+    val capped = chatRepository.dao.loadOlderSortAnchors(
+        sessionId,
+        beforeSortOrder,
+        com.openminis.app.data.repository.ChatRepository.MAX_TAIL_MESSAGES,
+    ).lastOrNull()?.sortOrder ?: return emptyList()
+    val start = maxOf(rawStart, capped)
     if (start >= beforeSortOrder) return emptyList()
     return loadSortRange(SortRange(start, beforeSortOrder))
 }

src/android/app/src/main/java/com/openminis/app/ui/chat/ChatModels.kt

@@ -83,6 +83,22 @@ data class ChatMessage(
     /** Vendor key for the speaker mark. Empty on ordinary assistant turns. */
     val speakerVendor: String? = null,
 ) {
+    /**
+     * [T-delete-anchor-by-id] Whether this row renders as a REAL user bubble:
+     * text, attachments, or both. A pure-image prompt has empty `content` but
+     * is a visible user turn — destructive rewinds must anchor to it rather
+     * than walk past it into the previous turn. Tool-result carriers and
+     * reminder-only rows render nothing and are filtered out before they ever
+     * reach the UI list.
+     */
+    val isRenderedUserBubble: Boolean
+        get() = role == "user" && (
+            content.isNotBlank() ||
+                imageUris.isNotEmpty() ||
+                attachmentUris.isNotEmpty() ||
+                attachmentNames.isNotEmpty()
+            )
+
     /**
      * [T-bridge-message-ui-leak-android] True when this UI message is the
      * internal role-alternation bridge that `injectQueuedPromptsAsNewTurn`

src/android/app/src/main/java/com/openminis/app/ui/chat/ChatScreen.kt

@@ -140,6 +140,7 @@ import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.RadioButtonChecked
 import androidx.compose.material.icons.filled.RadioButtonUnchecked
 import androidx.compose.material.icons.filled.Refresh
+import androidx.compose.material.icons.filled.Restore
 import androidx.compose.material3.ripple
 import androidx.compose.material3.DropdownMenu
 import androidx.compose.material3.DropdownMenuItem
@@ -887,6 +888,11 @@ fun ChatScreen(
     var showThinkingLevelSheet by remember { mutableStateOf(false) }
     var showAttachMenu by remember { mutableStateOf(false) }
     var showChatMenu by remember { mutableStateOf(false) }
+    LaunchedEffect(showChatMenu) {
+        if (showChatMenu) {
+            restorableCount = viewModel.restorableArchivedMessageCount()
+        }
+    }
     var showSkillsSheet by remember { mutableStateOf(false) }
     // [T-mcp-integration-android] MCPs-in-Session sheet visibility.
     var showMcpsSheet by remember { mutableStateOf(false) }
@@ -897,6 +903,11 @@ fun ChatScreen(
     // backing state without needing fragile scope wiring.
     var showMoveSheet by remember { mutableStateOf(false) }
     var showClearChatDialog by remember { mutableStateOf(false) }
+    // Archived rows whose live message is gone. 0 hides the restore action;
+    // recounts whenever the menu opens so a truncation made this session
+    // shows up without a reload.
+    var restorableCount by remember { mutableIntStateOf(0) }
+    var showRestoreDialog by remember { mutableStateOf(false) }
     var showCardShareDialog by remember { mutableStateOf(false) }
     // [T-android-delete-from-here] Id of the message a pending "Delete From
     // Here" would cut at, or null when no confirmation is open. Holding the
@@ -2685,6 +2696,16 @@ fun ChatScreen(
                                 },
                                 leadingIcon = { Icon(Icons.Default.Stop, contentDescription = null) },
                             )
+                            if (restorableCount > 0) {
+                                DropdownMenuItem(
+                                    text = { Text(stringResource(R.string.chat_menu_restore_deleted)) },
+                                    onClick = {
+                                        showChatMenu = false
+                                        showRestoreDialog = true
+                                    },
+                                    leadingIcon = { Icon(Icons.Default.Restore, contentDescription = null) },
+                                )
+                            }
                             DropdownMenuItem(
                                 text = { Text(stringResource(R.string.chat_menu_share_card)) },
                                 onClick = {
@@ -7282,6 +7303,23 @@ fun ChatScreen(
                     },
                 )
             }
+            if (showRestoreDialog) {
+                MinisAlertDialog(
+                    onDismissRequest = { showRestoreDialog = false },
+                    title = stringResource(R.string.chat_menu_restore_deleted),
+                    text = pluralStringResource(
+                        R.plurals.chat_restore_deleted_dialog_body,
+                        restorableCount,
+                        restorableCount,
+                    ),
+                    confirmText = stringResource(R.string.chat_restore_deleted_confirm),
+                    onConfirm = {
+                        viewModel.restoreArchivedMessages()
+                        showRestoreDialog = false
+                        restorableCount = 0
+                    },
+                )
+            }
             if (showClearChatDialog) {
                 MinisAlertDialog(
                     onDismissRequest = { showClearChatDialog = false },