feat(sessions): record when a task was archived

[liugddx]

Part of #5825 (first M3 PR). It adds a durable archive time that the later scoped cleanup ("archived more than N days") and retention steps from #5776 build on, and it shows that time to users now.

Why

Sessions have isArchived but no record of when they were archived. committed_at changes on every metadata update, so it can't stand in for one. Without a durable time there is no honest "archived more than N days" filter, and no retention clock.

What changes

Storage (session metadata schema 40 → 41)

• New column. Migration 41 adds a nullable session_metadata.archived_at (ms). There is no backfill. Rows archived before this change keep NULL, which means "unknown". The old payload time was stripped by migration 27 (refactor: make isArchived the sole session archive authority #3074), so there is nothing to recover.
• Written only by the lifecycle writes.
  • Archiving stamps it once per lifecycle write, shared by the revision family and any subtasks archived with it. When a retirement archives orphaned children, it uses the retirement's deleted_at.
  • Restoring clears it, and archiving again starts a fresh time.
  • Archiving something already archived keeps the first time.
  • Generic header writes can't change archive state, and they leave the column alone.
• Scope. The value lives on the catalog record only. It is not in the SessionHeader payload, which existing tests keep free of archivedAt.

Protocol (epoch 200 → 201)

• New field. SessionCatalogProjection.archivedAt is optional; an absent value means unknown.
• Decoding. The decoder rejects non-counts, and rejects archivedAt on a session that isn't archived. The Host projection emits the field only when the session is archived, so a stray value degrades to "no time" rather than dropping the task.
• No compatible-change declaration. Strict peers reject the unknown field, so a mismatched pair must fail admission rather than break later.

Desktop

• Row label. Settings › Archived tasks shows "Archived 3 days ago" on each row, or "Archive time unknown", in all three locales.
• Sort order. Rows sort by archive time, newest first, with unknown times last and ties kept in their existing order.

Docs. SessionSummary.archivedAt is documented as metadata only. isArchived stays the single archive state: unlike Projects, archivedAt === undefined does not mean "not archived".

Test doubles. The memory store now tracks the time too.

Verification

• Tests:
  • storage: archive, unrelated update, re-archive, restore, archive again, one time per lifecycle write (child equals the tombstone deleted_at), and v40 → v41 with legacy rows left NULL and unrewritten;
  • SQLite/memory conformance: archive tests 2/2;
  • runtime-host: protocol round trip and rejections, client summary projection, Host projection guard, retirement lifecycle;
  • desktop: row sort order.
• Mutation checks: every new assertion was checked by breaking its production line in dist, and each break fails its test.
• Migration on a real database: a v40 DB created by the previous build opens as v41 with legacy archived rows unchanged. The previous build then refuses the v41 DB ("newer than supported").
• Other checks: Biome, ASF headers, protocol-epoch-check (200 → 201), check-renderer-architecture --strict-base, locale hygiene, the Astryx inventory, the desktop typecheck and git diff --check.
• Running app: a disposable copy of a real workspace migrated on first start. Archiving shows "Archived just now", and restoring cleared archived_at in the DB. The screenshot shows the three states next to the M1 sizes:

The "3 days ago" and "unknown" rows were set directly in the DB copy to stand in for older and legacy data.

Not in this PR

"Archived more than N days" and project filters, batch delete preview, and retention. Those come next in #5825 and #5776.

AI use

Implemented and reviewed with Claude Code; the commits carry a Co-Authored-By trailer.

🤖 Generated with Claude Code

[hqhq1025]

Reviewed the current head. Schema 41 adds nullable archived_at without inventing a time for previously archived Sessions. Lifecycle archive writes stamp a revision family once, repeated archive preserves the first time, restore clears it, and ordinary header updates leave it unchanged. The catalog and Desktop projection distinguish an unknown archive time from active state and sort known times newest-first. I found no substantiated P0–P3 issue in the changed path. Node 24 clean npm ci and build:test, 314 focused Storage/Host/Desktop tests, diff-check, and static merge against current main pass. Current-head hosted test and label checks pass. I did not repeat the author’s real-workspace migration or packaged Desktop smoke test. This review is tied only to this head and current main; protocol epoch 201 will need re-evaluation if another pending epoch-201 PR lands first.\n\n> Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[Astro-Han]

Reviewed at 0f6318ae, focused on the migration and wire compatibility. No P0–P3 found.

• Schema 41: adds a nullable column with no backfill, guarded by hasColumn so replays are no-ops; existing archived rows stay NULL without touching their version/commit time. Older Hosts refuse the newer schema as with every prior migration, and bundle import still requires identical schemas.
• Single writer: only the archive/unarchive path sets archived_at — stamped only on an actual state change (re-archiving keeps the first time), cleared on unarchive, one timestamp per bulk archive, delete-time for children archived during delete; all other writes preserve the column, and nothing creates an already-archived Session, so forks/revisions/imports have nothing to copy.
• Protocol: archivedAt is optional, rejected by the decoder on non-archived rows and dropped Host-side rather than failing; the 200→201 bump is required since epoch-200 peers reject unknown keys, no earlier compatible-change declarations were rewritten, and the epoch guard passes against main.
• Ordering/UI: server paging still keys on activity + id, so cursors are unaffected; the archive-time sort is Desktop-only (newest first, unknown last, stable ties), and unknown times render as "Archive time unknown" instead of borrowing another timestamp.

Storage (206) and runtime-host catalog/protocol (125) tests pass locally. Not verified: the Desktop task-catalog-rows test (local UI build drift unrelated to this PR) and the settings page visually.

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

[Astro-Han]

Thanks @liugddx — a clean, well-scoped foundation for the archive-age cleanup: a single writer for the timestamp, an honest NULL for unknown history, and a correctly versioned wire field. Merging now.

[Astro-Han]

Approved at @Astro-Han's explicit request: two independent automated reviews of this head found no issues, and CI is green.